The CodeBuild service role lacks permissions to authenticate and pull from Amazon ECR is the most likely cause of the failure. The build environment is fetched before the buildspec runs and CodeBuild uses its service role to call ECR APIs to obtain an authorization token and to retrieve image layers.

The service role must grant permissions such as ecr GetAuthorizationToken, ecr BatchGetImage and ecr GetDownloadUrlForLayer and the role must be scoped to cover the target repository and region. Without those permissions CodeBuild cannot authenticate or download the image and the image pull fails before any build commands execute.

AWS CodeBuild does not support custom Docker images is incorrect because CodeBuild supports custom images hosted in Amazon ECR, Amazon ECR Public and Docker Hub. Custom environment images are a standard CodeBuild feature and are commonly used.

The image in Amazon ECR has no tags is unlikely to be the root cause because images can be referenced by digest as well as by tag. A missing tag by itself does not prevent a pull when the correct reference is provided.

The build environment is not configured for privileged mode is not relevant in this situation because privileged mode is required when the build needs to run Docker or build images inside the build. Privileged mode does not control the ability to pull the environment image from ECR.

Full AWS Practitioner Certification Question