How do I resolve the "error pulling image configuration: error parsing HTTP 403 response body" error in Amazon ECS?

Short description

Amazon ECR uses Amazon Simple Storage Service (Amazon S3) to store your image layers. When your containers download images from Amazon ECR, they access Amazon ECR to get the image manifest and then access Amazon S3 to download the image layers.

The Amazon S3 bucket that contains the layers for each Docker image uses the following Amazon Resource Name (ARN):

arn:aws:s3:::prod-region-starport-layer-bucket/*

Note: Replace region with your AWS Region.

If you use an Amazon S3 gateway endpoint in a route table with a policy that restricts access to starport-layer-bucket, then you receive this error message:

"error pulling image configuration: error parsing HTTP 403 response body: invalid character '<' looking for beginning of value: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>SAMPLE-REQUEST-ID</RequestId><HostId>SAMPLE-HOST-ID</HostId></Error>"

By default, a gateway endpoint provides full access to all Amazon S3 resources.

If you have a custom policy that allows access to specific resources, then add the starport-layer-bucket ARN to your Amazon Virtual Private Cloud (Amazon VPC) endpoint policy.

Resolution

To resolve this error, complete the following steps:

1. Open the Amazon VPC console.
2. From the navigation pane, choose Endpoints.
3. Select the Amazon S3 gateway endpoint.
4. Choose the Policy tab, and then choose Edit policy.
5. In the Resource section of the policy, add the following ARN:

   arn:aws:s3:::prod-region-starport-layer-bucket/*

   Note: Replace region with your AWS Region.

Example VPC endpoint policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Access-to-specific-buckets",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::prod-us-east-1-starport-layer-bucket/*"
      ]
    }
  ]
}

Related information

Create the Amazon S3 gateway endpoint