ECS Container ImageDigest is always nil for public images.

[sami-alajrami]

Confirm by changing [ ] to [x] below to ensure that it's a bug:

• [x] I've gone though the API reference
• [x] I've checked AWS Forums and StackOverflow for answers
• [x] I've searched for previous similar issues and didn't find any solution

Describe the bug ECS Containers returned by ecs.DescribeTasks always have ImageDigest set to nil even when the image is hosted in AWS ECR. This happens regardless of whether the container is running on Fargate or EC2.

It is also worth noting that the digest does not appear in the AWS Console UI too, so this might be an AWS API issue?

Version of AWS SDK for Go? 1.40.17

Version of Go (go version)? go1.16.3 darwin/arm64

To Reproduce (observed behavior)

1. Create an ECS service (either on Fargate or EC2) which uses a TaskDefinition that references an image hosted in ECR registry.
2. Use the following function to print some data (including the image digest) about Running ECS tasks:

func PrintEcsTasksData(client *ecs.Client, cluster string, serviceName string) error {
	listInput := &ecs.ListTasksInput{}
	descriptionInput := &ecs.DescribeTasksInput{}
	if serviceName != "" {
		listInput.ServiceName = aws.String(serviceName)
	}
	if cluster != "" {
		listInput.Cluster = aws.String(cluster)
		descriptionInput.Cluster = aws.String(cluster)
	}

	list, err := client.ListTasks(context.Background(), listInput)
	if err != nil {
		return err
	}
	tasks := list.TaskArns

	if len(tasks) > 0 {
		descriptionInput.Tasks = tasks
		result, err := client.DescribeTasks(context.Background(), descriptionInput)
		if err != nil {
			return err
		}

		for _, taskDesc := range result.Tasks {
			if *taskDesc.LastStatus == "RUNNING" {
				fmt.Printf("Task ARN: %s \n", *taskDesc.TaskArn)
				fmt.Printf("Started At: %v \n", *taskDesc.StartedAt)
				for i, container := range taskDesc.Containers {
					fmt.Printf("Container [%d] - image: %s \n", i, *container.Image)
					if container.ImageDigest != nil {
						fmt.Printf("Container [%d] - digest: %s \n", i, *container.ImageDigest)
					} else {
						fmt.Printf("Container [%d] -digest: does not have an ImageDigest \n", i)
					}
				}
				fmt.Println("---------------")

			}
		}
	}

	return nil
}

The output would look like this (with 3 tasks):

Task ARN: arn:aws:ecs:us-east-2:620836722962:task/test/e604a0bb950047c6ad66f453909b8868 
Started At: 2021-08-12 07:35:02.587 +0000 UTC 
Container [0]- image: public.ecr.aws/x1e6v9r9/nginx:latest 
Container [0] - digest: does not have an ImageDigest
---------------
Task ARN: arn:aws:ecs:us-east-2:620836722962:task/test/d7ee292c949d4ab7a57391bf30554694 
Started At: 2021-08-12 08:30:43.7 +0000 UTC 
Container [0]: public.ecr.aws/x1e6v9r9/nginx:v1.21.1 
Container [0]: does not have an ImageDigest 
---------------
Task ARN: arn:aws:ecs:us-east-2:620836722962:task/test/0e1c5f0fc58042bfa6e75cacf32e2c33 
Started At: 2021-08-12 07:44:30.399 +0000 UTC 
Container [0] - image: public.ecr.aws/x1e6v9r9/nginx@sha256:ce6ca11a3fa7e0e6b44813901e3289212fc2f327ee8b1366176666e8fb470f24 
Container [0] - digest: does not have an ImageDigest 

The used image has a digest in ECR:

Expected behavior ECS Task Container ImageDigest should be returned when the image is hosted in an AWS ECR registry as stated in https://github.com/aws/aws-sdk-go-v2/blob/f5c57ae60015c7b9558a059e9f291d2e05f38529/service/ecs/types/types.go#L438-L440

[vudh1]

Hi, can you confirm if this is still persisting with the newest version of SDK?

[github-actions[bot]]

This issue has not received a response in 1 week. If you want to keep this issue open, please just leave a comment below and auto-close will be canceled.

[sami-alajrami]

Hi @vudh1 , yes the issue is still there with SDK version v1.43.41. And to add more context, I discovered that the digest becomes available only if the image is private. So the issue occurs with public images regardless if it is on AWS ECR or another docker registry.

[lucix-aws]

@sami-alajrami - Do you get the same results in the CLI?

[github-actions[bot]]

This issue has not received a response in 1 week. If you want to keep this issue open, please just leave a comment below and auto-close will be canceled.