Skip to content

Instantly share code, notes, and snippets.

@karthikeayan

karthikeayan/cross_account_ecr_pull.txt

Created October 15, 2020 18:46
Show Gist options
  • Save karthikeayan/b5f36fd23fecd0c941302a9f90105370 to your computer and use it in GitHub Desktop.
Save karthikeayan/b5f36fd23fecd0c941302a9f90105370 to your computer and use it in GitHub Desktop.
Download ZIP
Allow other AWS Accounts to pull images from ECR
Raw
cross_account_ecr_pull.txt
Account A needs to pull images on Account B:
On Account A:
* Create a role in Account A
* Add policy which as ECR read access
On Account B:
* Create ECR Repository
* Add policy to the ECR Repository as below under permissions and replace <AccountA_ID>
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "AllowPull",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::<AccountA_ID>:root"
]
},
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:DescribeRepositories",
"ecr:GetAuthorizationToken",
"ecr:GetDownloadUrlForLayer",
"ecr:GetRepositoryPolicy",
"ecr:InitiateLayerUpload",
"ecr:ListImages"
]
}
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment