Please tell me about the permission settings when using an ECR from a different account with Lambda

AWSテクニカルサポートノート

#AWS

#Amazon ECR

#AWS Lambda

Nakamura Makoto

2024.09.25

日本語版はこちら

The issue

I plan to deploy a container image with Lambda, but the image is pushed to an ECR in a different account from Lambda.

How should I set the permissions in this case?

The solution

You need to set permissions in both the ECR resource-based policy and the IAM role for Lambda.

The required permissions are as follows:

ecr:BatchGetImage
ecr:GetDownloadUrlForLayer

AWS official documentation

To enable cross-account access, you can specify an entire account or IAM entities in another account as the principal in a resource-based policy. Adding a cross-account principal to a resource-based policy is only half of establishing the trust relationship. When the principal and the resource are in different AWS accounts, you must also grant the principal entity permission to access the resource.

The AWS Knowledge Center provides examples of policies, so please refer to them as well.

An example of an ECR resource-based policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CrossAccountPermission",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:root"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]
    },
    {
      "Sid": "LambdaECRImageCrossAccountRetrievalPolicy",
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Condition": {
        "StringLike": {
          "aws:sourceARN": "arn:aws:lambda:us-east-1:111111111111:function:*"
        }
      }
    }
  ]
}

An example of the IAM role for Lambda is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ECR Repository Access Permissions",
      "Effect": "Allow",
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage"
      ],
      "Resource": "arn:aws:ecr:us-east-1:222222222222:repository/hello-repository"
    }
  ]
}