Harbor Replication Issue with ECR in another AWS account

[sergdpi]

Harbor is running in an EKS cluster with a service account that has an IAM role, in AWS account 11111111.
Harbor is configured to replicate images to an ECR repository in AWS account 22222222. The IAM role for Harbor has been granted access to the ECR in account 22222222. Additionally, Harbor has access to the ECR in the same AWS account (11111111) where it is running.

Expected Behavior:
Harbor should create a repository and upload an image directly to the target ECR in AWS account 22222222.

Actual Behavior:
Harbor creates a repository in AWS account 11111111 and uploads the image to the ECR in AWS account 22222222 only if the repository already exists.

Steps to Reproduce:

1. Configure Harbor to run in an EKS cluster with a service account that has an IAM role in AWS account 11111111.
2. Attach an ECR repository in AWS account 22222222 to Harbor.
3. Configure access to the ECR for the Harbor IAM role.
4. Set up replication (event based) from Harbor to the remote ECR in AWS account 22222222.
5. Trigger a replication task.

Versions:
Please specify the versions of following systems.

• harbor version: v2.12.2-73072d0d
• helm chart version: 1.16.2
• EKS: 1.29

Additional Information:

• The IAM role for Harbor has the necessary permissions to create repositories and upload images in both AWS accounts.
• The errors occur only when there is no access to ECR in the same AWS account where the Harbor is running:
  Failed to do the prepare work for pushing/uploading resources: AccessDeniedException: User: arn:aws:sts::11111111:assumed-role/eks-eu-west-1-harbor/eks-... is not authorized to perform: ecr:DescribeRepositories on resource: arn:aws:ecr:eu-west-1:11111111:repository/container-registry/app because no identity-based policy allows the ecr:DescribeRepositories action status code: 400, request id: 7a6a..
  event_based

[wy65701436]

Let me clarify: You’ve set up an ECR registry endpoint with the account 22222222 in Harbor and triggered a push replication from Harbor to ECR, correct?

If that’s the case, Harbor will only use the 22222222 account to interact with ECR, regardless of the account configured in your Harbor instance.

[sergdpi]

Correct, I’ve configured the Harbor to ECR registry endpoint with the account 22222222. The replication rule configured with this endpoint also.

[wy65701436]

hi @sergdpi since the ECR is maintaining by the community, I will try to ping the owner to check this out.