Description
An ECR repository policy grants or restricts access to a particular repository. Its absence does not make the repository public; IAM identity policies can also grant access within the same account.
Potential impact
Adding a broad repository policy without considering its principals can grant unintended access to images.
Remediation
Check effective IAM permissions first. If a repository policy is needed, allow only the intended principals and actions. Grant ecr:GetAuthorizationToken through an IAM policy for image push and pull authentication.
Examples
The second example allows a specified role to perform two image-retrieval actions. Replace its ARN with the role that should receive access.
Before
hcl
resource "aws_ecr_repository" "example" {
name = "bar"
}
After
hcl
resource "aws_ecr_repository" "example" {
name = "bar"
}
resource "aws_ecr_repository_policy" "example_policy" {
repository = aws_ecr_repository.example.name
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "new policy",
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::123456789012:role/ImagePuller"},
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
]
}
]
}
EOF
}