DockerImageAsset - How to use published ECR image in a downstream image?

[JBoudMS]

Hi folks,

We currently have "base images" that our downstream containers pull from and we are in the process of upgrading from bespoke CDK pipelines to simple CDK pipelines using aws-cdk-lib/aws-ecr-assets. We had been doing this by sharing the URI of these base images using SSM as they are in separate projects & stacks.

I have been attempting to do this by importing the SSM into the downstream stack and passing the URI as a Buildarg, but I'm running into "Cannot use tokens in keys or values of "buildArgs" since they are needed before deployment", which as per issue #3981 is as intended.

This makes me think I'm doing this wrong, but I'm not sure what the best practice is to achieve this?

The architecture I was trying to achieve is like this:

Upstream stack:

const pythonDocker = new DockerImageAsset(this, 'python-3-base-image', {
	directory: join(thisDirectoryInSrc, '/python-3'),
	ignoreMode: IgnoreMode.DOCKER,
});

new StringParameter(this, 'python3-ecr-arn-ssm', {
	stringValue: pythonDocker.imageUri,
	description: 'Python 3 image repository URI',
	parameterName: '/docker-images/python-3/image-uri',
});

---

Downstream stack:

const baseImage = StringParameter.fromStringParameterName(this, 'python-3-base-image', '/docker-images/python-3/image-uri');

const feedReaderDocker = ContainerImage.fromAsset('src/feed-reader', {
	ignoreMode: IgnoreMode.DOCKER,
	buildArgs: {
		BASE_IMAGE: baseImage.stringValue
	},
});

Downstream Dockerfile:

ARG BASE_IMAGE
FROM BASE_IMAGE

# Install dependencies, declare entry point, etc

[indrora]

• If these are part of the same stack: https://docs.aws.amazon.com/cdk/v2/guide/resources.html#resource_stack
• Otherwise, you'll have to use https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecs.ContainerImage.html#static-fromwbrecrwbrrepositoryrepository-tag after getting the repository via https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecr.Repository.html