All 7 Elastic Container Registry (ECR) questions
More in Elastic Container Registry (ECR)
What is Amazon Elastic Container Registry and how does it fit into a containerized application workflow? How do you authenticate Docker to push and pull images from a private ECR repository? How does ECR image scanning help identify security vulnerabilities within container images before they are deployed? How do ECR lifecycle policies help automatically manage and clean up old or unused container images to control storage costs? How can ECR pull through cache repositories simplify managing dependencies on public container registries while maintaining private, controlled access? How should an organization design a comprehensive container image governance strategy across multiple ECR repositories, teams, and AWS accounts?
Advertisement
AWS › Elastic Container Registry (ECR)

How can ECR repository policies control which IAM users, roles, or other AWS accounts can access a specific container image repository?

Intermediate

Answer

ECR repository policies work similarly to S3 bucket policies, letting you explicitly define which IAM principals, potentially including principals from a completely different AWS account, are allowed to perform specific actions such as pulling or pushing images to a particular repository, which is especially useful when sharing container images across multiple accounts in an organization without making the repository publicly accessible.
aws ecr set-repository-policy --repository-name my-app --policy-text file://ecr-repository-policy.json
Real-world example A company sharing a common base container image across several development teams in separate AWS accounts configures an ECR repository policy that grants pull access to those specific accounts, without needing to duplicate the same image into every individual account's own registry.

Common follow-ups: How do you grant cross account access to a specific ECR repository?;What is the difference between a repository policy and an IAM policy for controlling ECR access?

IAM;AWS Organizations & Multi Account Strategy
All 7 Elastic Container Registry (ECR) questions