fix(apprunner): auto deployment fails after new container image pushed due to lack of a permission

[mazyu36]

Issue # (if applicable)

Closes #26640

Reason for this change

According to the docs, required permissions for an App Runner's AccessRole to access images in ECR repository are the followings:

1. "ecr:GetDownloadUrlForLayer",
2. "ecr:BatchCheckLayerAvailability",
3. "ecr:BatchGetImage",
4. "ecr:DescribeImages",
5. "ecr:GetAuthorizationToken"

No.1~3 are granted by the grantPull method of ecr.Repository.

https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-apprunner-alpha/lib/service.ts#L1303

Permission for No.5 is granted by the following.
Note : It is correct that the resources here is set to *(Ref: docs)

If you create your own custom policy for your access role, be sure to specify "Resource": "*" for the ecr:GetAuthorizationToken action. Tokens can be used to access any Amazon ECR registry that you have access to.

https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-apprunner-alpha/lib/service.ts#L1368

At the moment, No.4 permission is missing. So we need to add.

Description of changes

Add a ecr:DescribeImages permisison to the AccessRole.

Description of how you validated changes

Update a unit test and a integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[go-to-k]

Looks good!

[GavinZZ]

LGTM, thanks for contributing.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 06c3b5c
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.