Unable to Create Policy for AWS ECR

Question

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPushPull",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<account_id>:user/root"
            },
            "Action": [
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ],
            "Resource": [
                "xxx.dkr.ecr.us-west-2.amazonaws.com/yyy"
            ]
        }
    ]
}

Command I try to use is:

aws ecr set-repository-policy --repository-name yyy --policy-text file://ecr-policy.json

If I do ls in my linux machine I can see this ecr-policy.json in same folder where I run this command.

I want to grant access to myself.

I am always getting error:

An error occurred (InvalidParameterException) when calling the SetRepositoryPolicy operation: Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Invalid repository policy provided'

I checked my AWS ARN and it ends with root.

You want grant another account or users in an account to access your ECR? — gohm'c, Mar 21 '22 at 15:28
None of the [Private repository policy examples - Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html) have `Resource` field -- could that be the cause? Also, do you have an actual IAM User called `root`, or are you wanting to grant the access to the "Root User" of your AWS Account? — John Rotenstein, Mar 21 '22 at 23:25

gohm'c · Answer 1 · 2022-03-22T03:04:13.190

i want to grant access to myself.

You don't need a resource section because this statement will be attached to a specific repository. Try add the following statement at Console > ECR > Repositories > [Select a repo on the Images table] > Permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPushPull",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::<account #>:user/<your IAM user name>",
                    "arn:aws:iam::<account #>:root"
                ]
            },
            "Action": [
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ]
        }
    ]
}

NOTE: Replace <account #> with your AWS account ID.

API error Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Invalid registry policy provided' — dotnetavalanche, Mar 22 '22 at 02:38
Checkout the updated answer. Do you get the error when you try on the console `Console > ECR > Repositories > Permissions`? — gohm'c, Mar 22 '22 at 03:01

score 1 · Answer 2 · answered Mar 22 '22 at 01:34

Remove Resource in Policy json file

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPushPull",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<account_id>:user/root"
            },
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchDeleteImage",
                "ecr:BatchGetImage",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:ListImages",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ]
        }
    ]
}

Or you can set on AWS Console

Go to Amazon ECR > Repositories
Create Repository
Click what your create Repository
and go to permissions tab
Edit permissions -> Input the above json file

score 1 · Accepted Answer · answered Jan 27 '23 at 10:35

1

try resource in a format:

arn:${Partition}:ecr:${Region}:${Account}:repository/${Repository-name}

https://docs.aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html

answered Jan 27 '23 at 10:35

syma

26
1

Unable to Create Policy for AWS ECR

3 Answers3