Add new values for ECRAccessPolicy that include ecr:BatchImportUpstreamImage
#1270
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DrJosh9000
approved these changes
Dec 7, 2023
yob
reviewed
Dec 7, 2023
| Statement: | ||
| - Effect: Allow | ||
| Action: | ||
| - ecr:BatchImportUpstreamImage |
There was a problem hiding this comment.
you may also want ecr:CreateRepository here. That permission is required for the first pull of a new image that's never been cached before. After that, ecr:BatchImportUpstreamImage is enough to pull new tags of the image into the repository.
There was a problem hiding this comment.
Oh right, the docs state it as
Grants permission to create a repository in a private registry.
but the "repository" is just the part of the image w/o the tag.
This is needed for create the repository for the image in the pull-through cache. While there is a risk that users could create repositories in non-pull-through caches, they won't necessarily be able to upload any layers to that repository.
DrJosh9000
approved these changes
Dec 7, 2023
+ is not a valid character in a mapping name for CloudFormation, even though it is for YAML.
|
This turned into more of a saga than I thought. I'm going put it back to draft and rework it a little. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This IAM permission is necessary to use an ECR pull through cache. Technically, it is not
readonly, as images will be written to the pull though cache on cache misses. Surprisingly, it is not inpowerusereither. But we think customers will want to give Stacks the ability to use pull through caches without giving full permissions.See https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html for more details.