Please tell me about the permission settings when using an ECR from a different account with Lambda
この記事は公開されてから1年以上経過しています。情報が古い可能性がありますので、ご注意ください。
The issue
I plan to deploy a container image with Lambda, but the image is pushed to an ECR in a different account from Lambda.
How should I set the permissions in this case?
The solution
You need to set permissions in both the ECR resource-based policy and the IAM role for Lambda.
The required permissions are as follows:
- ecr:BatchGetImage
- ecr:GetDownloadUrlForLayer
To enable cross-account access, you can specify an entire account or IAM entities in another account as the principal in a resource-based policy. Adding a cross-account principal to a resource-based policy is only half of establishing the trust relationship. When the principal and the resource are in different AWS accounts, you must also grant the principal entity permission to access the resource.
The AWS Knowledge Center provides examples of policies, so please refer to them as well.
An example of an ECR resource-based policy is as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CrossAccountPermission",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:root"
},
"Action": [
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
]
},
{
"Sid": "LambdaECRImageCrossAccountRetrievalPolicy",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": [
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
],
"Condition": {
"StringLike": {
"aws:sourceARN": "arn:aws:lambda:us-east-1:111111111111:function:*"
}
}
}
]
}
An example of the IAM role for Lambda is as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ECR Repository Access Permissions",
"Effect": "Allow",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
],
"Resource": "arn:aws:ecr:us-east-1:222222222222:repository/hello-repository"
}
]
}
