title: Terraform ECR STOPPED (CannotPullECRContainerError: AccessDeniedException)
body: <p>I am trying to deploy a website container through Terraform.
  Everything goes right, just the task fails with</p>
  <blockquote>
  <p>STOPPED (CannotPullECRContainerError: AccessDeniedException)</p>
  </blockquote>
  <p>Here is a copy of my Terraform script:</p>
  <pre><code>    # Specify the provider and access details
      provider &quot;aws&quot; {
        region = &quot;${var.aws_region}&quot;
        access_key = &quot;${var.access_key}&quot;
        secret_key = &quot;${var.secret_key}&quot;
      }
  
      ## EC2
  
      ### Network
  
      data &quot;aws_availability_zones&quot; &quot;available&quot; {}
  
      resource &quot;aws_vpc&quot; &quot;main&quot; {
        cidr_block = &quot;10.10.0.0/16&quot;
      }
  
      resource &quot;aws_subnet&quot; &quot;main&quot; {
        count             = &quot;${var.az_count}&quot;
        cidr_block        = &quot;${cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)}&quot;
        availability_zone = &quot;${data.aws_availability_zones.available.names[count.index]}&quot;
        vpc_id            = &quot;${aws_vpc.main.id}&quot;
      }
  
      resource &quot;aws_internet_gateway&quot; &quot;gw&quot; {
        vpc_id = &quot;${aws_vpc.main.id}&quot;
      }
  
      resource &quot;aws_route_table&quot; &quot;r&quot; {
        vpc_id = &quot;${aws_vpc.main.id}&quot;
  
        route {
          cidr_block = &quot;0.0.0.0/0&quot;
          gateway_id = &quot;${aws_internet_gateway.gw.id}&quot;
        }
      }
  
      resource &quot;aws_route_table_association&quot; &quot;a&quot; {
        count          = &quot;${var.az_count}&quot;
        subnet_id      = &quot;${element(aws_subnet.main.*.id, count.index)}&quot;
        route_table_id = &quot;${aws_route_table.r.id}&quot;
      }
  
      ### Compute
  
      resource &quot;aws_autoscaling_group&quot; &quot;app&quot; {
        name                 = &quot;tf-website-asg&quot;
        vpc_zone_identifier  = [&quot;${aws_subnet.main.*.id}&quot;]
        min_size             = &quot;${var.asg_min}&quot;
        max_size             = &quot;${var.asg_max}&quot;
        desired_capacity     = &quot;${var.asg_desired}&quot;
        launch_configuration = &quot;${aws_launch_configuration.app.name}&quot;
      }
  
      data &quot;template_file&quot; &quot;cloud_config&quot; {
        template = &quot;${file(&quot;${path.module}/cloud-config.yml&quot;)}&quot;
  
        vars {
          aws_region         = &quot;${var.aws_region}&quot;
          ecs_cluster_name   = &quot;${aws_ecs_cluster.main.name}&quot;
          ecs_log_level      = &quot;info&quot;
          ecs_agent_version  = &quot;latest&quot;
          ecs_log_group_name = &quot;${aws_cloudwatch_log_group.ecs.name}&quot;
        }
      }
  
      data &quot;aws_ami&quot; &quot;stable_coreos&quot; {
        most_recent = true
  
        filter {
          name   = &quot;description&quot;
          values = [&quot;CoreOS Container Linux stable *&quot;]
        }
  
        filter {
          name   = &quot;architecture&quot;
          values = [&quot;x86_64&quot;]
        }
  
        filter {
          name   = &quot;virtualization-type&quot;
          values = [&quot;hvm&quot;]
        }
  
        owners = [&quot;595879546273&quot;] # CoreOS
      }
  
      resource &quot;aws_launch_configuration&quot; &quot;app&quot; {
        security_groups = [
          &quot;${aws_security_group.instance_sg.id}&quot;,
        ]
  
        key_name                    = &quot;${var.key_name}&quot;
        image_id                    = &quot;${data.aws_ami.stable_coreos.id}&quot;
        instance_type               = &quot;${var.instance_type}&quot;
        iam_instance_profile        = &quot;${aws_iam_instance_profile.app.name}&quot;
        user_data                   = &quot;${data.template_file.cloud_config.rendered}&quot;
        associate_public_ip_address = true
  
        lifecycle {
          create_before_destroy = true
        }
      }
  
      ### Security
  
      resource &quot;aws_security_group&quot; &quot;lb_sg&quot; {
        description = &quot;controls access to the application ELB&quot;
  
        vpc_id = &quot;${aws_vpc.main.id}&quot;
        name   = &quot;tf-ecs-lbsg&quot;
  
        ingress {
          protocol    = &quot;tcp&quot;
          from_port   = 80
          to_port     = 80
          cidr_blocks = [&quot;0.0.0.0/0&quot;]
        }
  
        egress {
          from_port = 0
          to_port   = 0
          protocol  = &quot;-1&quot;
  
          cidr_blocks = [
            &quot;0.0.0.0/0&quot;,
          ]
        }
      }
  
      resource &quot;aws_security_group&quot; &quot;instance_sg&quot; {
        description = &quot;controls direct access to application instances&quot;
        vpc_id      = &quot;${aws_vpc.main.id}&quot;
        name        = &quot;tf-ecs-instsg&quot;
  
        ingress {
          protocol  = &quot;tcp&quot;
          from_port = 22
          to_port   = 22
  
          cidr_blocks = [
            &quot;${var.admin_cidr_ingress}&quot;,
          ]
        }
  
        ingress {
          protocol  = &quot;tcp&quot;
          from_port = 80
          to_port   = 80
  
          security_groups = [
            &quot;${aws_security_group.lb_sg.id}&quot;,
          ]
        }
  
        egress {
          from_port   = 0
          to_port     = 0
          protocol    = &quot;-1&quot;
          cidr_blocks = [&quot;0.0.0.0/0&quot;]
        }
      }
  
      ## ECS
  
      resource &quot;aws_ecs_cluster&quot; &quot;main&quot; {
        name = &quot;terraform_website_ecs_cluster&quot;
      }
  
      data &quot;template_file&quot; &quot;task_definition&quot; {
        template = &quot;${file(&quot;${path.module}/task-definition.json&quot;)}&quot;
  
        vars {
          image_url        = &quot;xxxxx.dkr.ecr.eu-west-1.amazonaws.com/nginx:latest&quot;
          container_name   = &quot;website&quot;
          log_group_region = &quot;${var.aws_region}&quot;
          log_group_name   = &quot;${aws_cloudwatch_log_group.app.name}&quot;
        }
      }
  
      resource &quot;aws_ecs_task_definition&quot; &quot;website&quot; {
        family                = &quot;tf_website_td&quot;
        container_definitions = &quot;${data.template_file.task_definition.rendered}&quot;
      }
  
      resource &quot;aws_ecs_service&quot; &quot;test&quot; {
        name            = &quot;tf-ecs-website&quot;
        cluster         = &quot;${aws_ecs_cluster.main.id}&quot;
        task_definition = &quot;${aws_ecs_task_definition.website.arn}&quot;
        desired_count   = 1
        iam_role        = &quot;${aws_iam_role.ecs_service.name}&quot;
  
        load_balancer {
          target_group_arn = &quot;${aws_alb_target_group.test.id}&quot;
          container_name   = &quot;website&quot;
          container_port   = &quot;80&quot;
        }
  
        depends_on = [
          &quot;aws_iam_role_policy.ecs_service&quot;,
          &quot;aws_alb_listener.front_end&quot;,
        ]
      }
  
      ## IAM
  
      resource &quot;aws_iam_role&quot; &quot;ecs_service&quot; {
        name = &quot;tf_website_ecs_role&quot;
  
        assume_role_policy = &lt;&lt;EOF
      {
        &quot;Version&quot;: &quot;2008-10-17&quot;,
        &quot;Statement&quot;: [
          {
            &quot;Sid&quot;: &quot;&quot;,
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Principal&quot;: {
              &quot;Service&quot;: &quot;ecs.amazonaws.com&quot;
            },
            &quot;Action&quot;: &quot;sts:AssumeRole&quot;
          }
        ]
      }
      EOF
      }
  
      resource &quot;aws_iam_role_policy&quot; &quot;ecs_service&quot; {
        name = &quot;tf_website_ecs_policy&quot;
        role = &quot;${aws_iam_role.ecs_service.name}&quot;
  
        policy = &lt;&lt;EOF
      {
        &quot;Version&quot;: &quot;2012-10-17&quot;,
        &quot;Statement&quot;: [
          {
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
              &quot;ec2:Describe*&quot;,
              &quot;elasticloadbalancing:DeregisterInstancesFromLoadBalancer&quot;,
              &quot;elasticloadbalancing:DeregisterTargets&quot;,
              &quot;elasticloadbalancing:Describe*&quot;,
              &quot;elasticloadbalancing:RegisterInstancesWithLoadBalancer&quot;,
              &quot;elasticloadbalancing:RegisterTargets&quot;,
              &quot;ecr:GetAuthorizationToken&quot;
            ],
            &quot;Resource&quot;: &quot;*&quot;
          }
        ]
      }
      EOF
      }
  
      resource &quot;aws_iam_instance_profile&quot; &quot;app&quot; {
        name = &quot;tf-ecs-instprofile&quot;
        role = &quot;${aws_iam_role.app_instance.name}&quot;
      }
  
      resource &quot;aws_iam_role&quot; &quot;app_instance&quot; {
        name = &quot;tf-ecs-website-instance-role&quot;
  
        assume_role_policy = &lt;&lt;EOF
      {
        &quot;Version&quot;: &quot;2012-10-17&quot;,
        &quot;Statement&quot;: [
          {
            &quot;Sid&quot;: &quot;&quot;,
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Principal&quot;: {
              &quot;Service&quot;: &quot;ec2.amazonaws.com&quot;
            },
            &quot;Action&quot;: &quot;sts:AssumeRole&quot;
          }
        ]
      }
      EOF
      }
  
      data &quot;template_file&quot; &quot;instance_profile&quot; {
        template = &quot;${file(&quot;${path.module}/instance-profile-policy.json&quot;)}&quot;
  
        vars {
          app_log_group_arn = &quot;${aws_cloudwatch_log_group.app.arn}&quot;
          ecs_log_group_arn = &quot;${aws_cloudwatch_log_group.ecs.arn}&quot;
        }
      }
  
      resource &quot;aws_iam_role_policy&quot; &quot;instance&quot; {
        name   = &quot;TfEcsInstanceRole&quot;
        role   = &quot;${aws_iam_role.app_instance.name}&quot;
        policy = &quot;${data.template_file.instance_profile.rendered}&quot;
      }
  
      ## ALB
  
      resource &quot;aws_alb_target_group&quot; &quot;test&quot; {
        name     = &quot;tf-website-ecs-website&quot;
        port     = 80
        protocol = &quot;HTTP&quot;
        vpc_id   = &quot;${aws_vpc.main.id}&quot;
      }
  
      resource &quot;aws_alb&quot; &quot;main&quot; {
        name            = &quot;tf-website-alb-ecs&quot;
        subnets         = [&quot;${aws_subnet.main.*.id}&quot;]
        security_groups = [&quot;${aws_security_group.lb_sg.id}&quot;]
      }
  
      resource &quot;aws_alb_listener&quot; &quot;front_end&quot; {
        load_balancer_arn = &quot;${aws_alb.main.id}&quot;
        port              = &quot;80&quot;
        protocol          = &quot;HTTP&quot;
  
        default_action {
          target_group_arn = &quot;${aws_alb_target_group.test.id}&quot;
          type             = &quot;forward&quot;
        }
      }
  
      ## CloudWatch Logs
  
      resource &quot;aws_cloudwatch_log_group&quot; &quot;ecs&quot; {
        name = &quot;tf-ecs-group/ecs-agent&quot;
      }
  
      resource &quot;aws_cloudwatch_log_group&quot; &quot;app&quot; {
        name = &quot;tf-ecs-group/app-website&quot;
      }
  </code></pre>
  <p>Thanks for the help</p>