Aws-codebuild-docker-images: Failing with cannot use a CodeBuild curated image with imagePullCredentialsType SERVICE_ROLE

[siboulet]

We've been using CodeBuild to build Docker images for a little while. Over the weekend all our Docker builds using the docker image started to fail with "cannot use a CodeBuild curated image with imagePullCredentialsType SERVICE_ROLE".

We're using the aws/codebuild/docker:17.09.0 image as outlined in https://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html.

I tried recreating the project in the CodeBuild console and getting the same error when saving the project: "Invalid input: cannot use a CodeBuild curated image with imagePullCredentialsType SERVICE_ROLE".

[siboulet]

Oh, wait a minute. I'm 100% sure the above is how I initially configured our project. But I just tried going to the "Managed Image" list and picking Docker from there and it seems to work now.

Closing.

[leoherran-aws]

CodeBuild now supports pulling images with two different sets of credentials: your project's service role (new) or CodeBuild's own service credentials (default option). When you select Custom image in the console, it automatically selects the service role credentials option. Since we don't support pulling CodeBuild curated images with service role credentials, the error appeared when trying to update your project.

I'll see if we can add an exception to this logic to prevent further confusion. Thanks for letting us know about this issue.

[ookangzheng]

Just now I also got this error
CDK version: 1.32.0, Typescript
OS version: OSX 10.15.4

cannot use a CodeBuild curated image with imagePullCredentialsType SERVICE_ROLE
I try to switch between from DockerRegistry to Codebuild curated image

environment: {
          // buildImage: LinuxBuildImage.fromDockerRegistry('docker:dind')
          buildImage: LinuxBuildImage.STANDARD_4_0
        }

[leoherran-aws]

CodeBuild supports pulling images with two different sets of credentials: your project's service role or CodeBuild's own service credentials. We don't support pulling CodeBuild curated images with service role credentials, so you'll need to update imagePullCredentialsType from SERVICE_ROLE to CODEBUILD in order to configure your project with a CodeBuild image.

[DVMVCGCG]

There seems to be a CDK bug where the Environment.ImagePullCredentialType is not emitted in the CF template even when setting the buildImage to a CodeBuild provided image such as in the example provided by @ookangzheng above. I had to use a raw property override to get rid of the cannot use a CodeBuild curated image with imagePullCredentialsType SERVICE_ROLE error.

const cfnProject = codeBuildProject.node.findChild('Resource') as codebuild.CfnProject
cfnProject.addPropertyOverride(
    'Environment.ImagePullCredentialsType',
    'CODEBUILD'
)

[jamescosford]

I just came across this issue. I had been building with a custom image and decided to try with a curated image, but was blocked by this issue until I found @DVMVCGCG 's solution.