AWS lambda documentation change
Summary
Specified exact ECR permissions (ecr:BatchGetImage and GetDownloadUrlForLayer) that Lambda adds automatically
Security assessment
Documents specific permissions required for container image access, improving transparency about security controls but not addressing a known vulnerability.
Diff
diff --git a/lambda/latest/dg/images-create.md b/lambda/latest/dg/images-create.md index 1072bd923..dc6fdcfd2 100644 --- a/lambda/latest/dg/images-create.md +++ b/lambda/latest/dg/images-create.md @@ -207 +207 @@ For more information about Amazon ECR repository permissions, see [Private repos -If the Amazon ECR repository does not include these permissions, Lambda attempts to add them automatically. Lambda can add permissions only if the principal calling Lambda has `ecr:getRepositoryPolicy` and `ecr:setRepositoryPolicy` permissions. +If the Amazon ECR repository does not include these permissions, Lambda adds `ecr:BatchGetImage` and `ecr:GetDownloadUrlForLayer` to the container image repository permissions. Lambda can add these permissions only if the principal calling Lambda has `ecr:getRepositoryPolicy` and `ecr:setRepositoryPolicy` permissions.