Please tell me about the permission settings when using an ECR from a different account with Lambda
2024.09.25The issue
I plan to deploy a container image with Lambda, but the image is pushed to an ECR in a different account from Lambda.
How should I set the permissions in this case?
The solution
You need to set permissions in both the ECR resource-based policy and the IAM role for Lambda.
The required permissions are as follows:
- ecr:BatchGetImage
- ecr:GetDownloadUrlForLayer
To enable cross-account access, you can specify an entire account or IAM entities in another account as the principal in a resource-based policy. Adding a cross-account principal to a resource-based policy is only half of establishing the trust relationship. When the principal and the resource are in different AWS accounts, you must also grant the principal entity permission to access the resource.
The AWS Knowledge Center provides examples of policies, so please refer to them as well.
An example of an ECR resource-based policy is as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CrossAccountPermission",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:root"
},
"Action": [
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
]
},
{
"Sid": "LambdaECRImageCrossAccountRetrievalPolicy",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": [
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
],
"Condition": {
"StringLike": {
"aws:sourceARN": "arn:aws:lambda:us-east-1:111111111111:function:*"
}
}
}
]
}
An example of the IAM role for Lambda is as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ECR Repository Access Permissions",
"Effect": "Allow",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
],
"Resource": "arn:aws:ecr:us-east-1:222222222222:repository/hello-repository"
}
]
}
![[レポート] SaaSアプリケーションの次世代設計について学ぶ「Next generation SaaS: Scale, resilience, and operational efficiency」 #PEX304](https://images.ctfassets.net/ct0aopd36mqt/3IQLlbdUkRvu7Q2LupRW2o/edff8982184ea7cc2d5efa2ddd2915f5/reinvent-2024-sessionreport-jp.jpg)
