From 4d7a660f88dd4ad377d1cd68ff09a26f8b6863ab Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Tue, 5 May 2026 10:55:26 -0400
Subject: [PATCH] Fix pipeline: add ECR permissions and enable Docker for
 Fargate image builds

---
 pipeline.yaml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/pipeline.yaml b/pipeline.yaml
index 29f19bf..56369f0 100644
--- a/pipeline.yaml
+++ b/pipeline.yaml
@@ -69,6 +69,21 @@ Resources:
                   - !Sub "arn:aws:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
                   - !Sub "arn:aws:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}"
                   - !Sub "arn:aws:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}"
+              - Effect: Allow
+                Action:
+                  - ecr:GetAuthorizationToken
+                Resource: "*"
+              - Effect: Allow
+                Action:
+                  - ecr:DescribeRepositories
+                  - ecr:BatchCheckLayerAvailability
+                  - ecr:GetDownloadUrlForLayer
+                  - ecr:BatchGetImage
+                  - ecr:PutImage
+                  - ecr:InitiateLayerUpload
+                  - ecr:UploadLayerPart
+                  - ecr:CompleteLayerUpload
+                Resource: !Sub "arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/cdk-hnb659fds-container-assets-${AWS::AccountId}-${AWS::Region}"
 
   CodeBuildProject:
     Type: AWS::CodeBuild::Project
@@ -83,7 +98,7 @@ Resources:
         ComputeType: BUILD_GENERAL1_SMALL
         Image: aws/codebuild/amazonlinux-aarch64-standard:3.0
         EnvironmentVariables: []
-        PrivilegedMode: false
+        PrivilegedMode: true
       Source:
         Type: CODEPIPELINE
         BuildSpec: buildspec.yml
-- 
2.50.1