Getting the following error with ECR: LayerError: Failed to extract layer for image scan.

[npearson72]

Here's my setup with Github Actions:

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Build and push image to AWS ECR
        uses: docker/build-push-action@v4
        with:
          context: .
          cache-from: type=gha
          cache-to: type=gha,mode=max
          push: true
          tags: |
            ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}
            ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:latest

While the image does eventually get pushed successfully, there's always one artifact that shows up as failed:

This is what it looks like when I describe the image:

        {
            "registryId": "my-registry-id",
            "repositoryName": "terraform-app-repo",
            "imageDigest": "sha256:70dc7ac41a294526cfe1f9a9a2d33719924f826e7ee80da316655824e427b391",
            "imageSizeInBytes": 1620,
            "imagePushedAt": "2023-08-30T10:17:05-05:00",
            "imageScanStatus": {
                "status": "FAILED",
                "description": "LayerError: Failed to extract layer for image scan."
            },
            "imageManifestMediaType": "application/vnd.oci.image.manifest.v1+json",
            "artifactMediaType": "application/vnd.oci.image.config.v1+json",
            "lastRecordedPullTime": "2023-08-30T10:17:06.570000-05:00"
        }

Any ideas why this is happening?

[susovan87]

I had the similar issue. Came to know, ECR does not like the attestation layers pushed when security scanning is enabled on a repository. You may consider using provenance: false to disable pushing attestation layers into ECR. #746