Terraform resource: aws ecr repository policy

• aws_ecr_repository_policy ref

Examples

Official example

resource "aws_ecr_repository" "foo" {
  name = "bar"
}

data "aws_iam_policy_document" "foopolicy" {
  statement {
    sid    = "new policy"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["123456789012"]
    }

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:PutImage",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:DescribeRepositories",
      "ecr:GetRepositoryPolicy",
      "ecr:ListImages",
      "ecr:DeleteRepository",
      "ecr:BatchDeleteImage",
      "ecr:SetRepositoryPolicy",
      "ecr:DeleteRepositoryPolicy",
    ]
  }
}

resource "aws_ecr_repository_policy" "foopolicy" {
  repository = aws_ecr_repository.foo.name
  policy     = data.aws_iam_policy_document.foopolicy.json
}

Example

resource "aws_ecr_repository_policy" "access_policy" {
 for_each   = toset(var.your-org_ecr_repos)
 repository = each.key

 policy = <<EOF
{
 "Version": "2008-10-17",
 "Statement": [
   {
     "Sid": "AllowPushPull",
     "Effect": "Allow",
     "Principal": {
       "AWS": [
         "arn:aws:iam::0123456789:root",
         "arn:aws:iam::9876543210:user/MyAdmin"
       ]
     },
     "Action": [
       "ecr:GetDownloadUrlForLayer",
       "ecr:BatchGetImage",
       "ecr:BatchCheckLayerAvailability",
       "ecr:PutImage",
       "ecr:InitiateLayerUpload",
       "ecr:UploadLayerPart",
       "ecr:CompleteLayerUpload"
     ]
   }
 ]
}
EOF

 depends_on = [aws_ecr_repository.your-org_repos]
}

Related

• aws_ecr_repository

See also

• Terraform AWS ECR: aws_ecr_repository, aws_ecr_repository_policy, aws_ecrpublic_repository, aws_ecrpublic_repository_policy
• ECR, aws ecr, public.ecr.aws, Terraform AWS ECR, Troubleshooting ECR, ecr: