Hello,
Is it possible to grant AWS permissions to cloud agents during build time to pull from a private ECR via the docs here without Bedrock access? When configuring the ARN to get an external ID it looks like (or at least is worded like) Bedrock access is required in the IAM policy.
Hi @kkchau Yes you can! you can use an ECR-only policy. Bedrock access isn’t required. The role you point Cursor at only gets assumed via sts:AssumeRole, so it has exactly the permissions you attach, no bedrock:* needed.
The reason it looks Bedrock-related is just that the External ID generator currently lives in the Bedrock IAM Role panel. The External ID itself is generic and team-wide. If the panel doesn’t show one yet, type any ARN-shaped string into the “AWS IAM Role ARN” field (e.g. arn:aws:iam::123456789012:role/placeholder), click Validate & Save, and reload. The validation error is expected and safe to ignore. The External ID still gets created, and that field isn’t the one cloud agents use anyway, so the placeholder value doesn’t matter. You can then copy the External ID into your role’s trust policy as described in the docs you linked.
Let me know if you have any follow-up questions!
Thank you for confirming, @kevinn! We were able to generate the external ID with an ARN just scoped to ECR. However, now that I’ve set up the the proper IAM role and trust policy with that external ID and set theCURSOR_AWS_ASSUME_IAM_ROLE_ARNbuild time secret, I’m still receiving 401s when trying to pull down the base image from our private ECR to build a cloud environment image. Is there a way we can inspect the full build logs/process?
Request ID: bc-d5eac415-da4e-4bc8-84cb-93048690183d
