AWS AmazonECR documentation change

Service: AmazonECR · 2025-10-25 · Documentation low

File: AmazonECR/latest/userguide/repository-policy-examples.md

Summary

Added multiple JSON policy examples demonstrating repository access controls including push/pull permissions, admin access, explicit deny rules, and CodeBuild integration with condition constraints

Security assessment

The changes add security-focused IAM policy examples showing least-privilege access patterns and explicit deny rules. The CodeBuild example demonstrates security best practices with aws:SourceArn and aws:SourceAccount conditions to prevent confused deputy issues. While these are security improvements, there's no evidence they address a specific disclosed vulnerability.

Diff

diff --git a/AmazonECR/latest/userguide/repository-policy-examples.md b/AmazonECR/latest/userguide/repository-policy-examples.md
index c8e542328..8bd7eb495 100644
--- a//AmazonECR/latest/userguide/repository-policy-examples.md
+++ b//AmazonECR/latest/userguide/repository-policy-examples.md
@@ -24,0 +25,34 @@ The following repository policy allows one or more users to push and pull images
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Sid": "AllowPushPull",
+                "Effect": "Allow",
+                "Principal": {
+                    "AWS": [
+                        "arn:aws:iam::111122223333:user/push-pull-user-1",
+                        "arn:aws:iam::111122223333:user/push-pull-user-2"
+                    ]
+                },
+                "Action": [
+                    "ecr:BatchGetImage",
+                    "ecr:BatchCheckLayerAvailability",
+                    "ecr:CompleteLayerUpload",
+                    "ecr:GetDownloadUrlForLayer",
+                    "ecr:InitiateLayerUpload",
+                    "ecr:PutImage",
+                    "ecr:UploadLayerPart"
+                ],
+                "Resource": "*"
+            }
+        ]
+    }
+    
+
@@ -67,0 +102,40 @@ For more complicated repository policies that are not currently supported in the
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Sid": "AllowPull",
+                "Effect": "Allow",
+                "Principal": {
+                    "AWS": [
+                        "arn:aws:iam::111122223333:user/pull-user-1",
+                        "arn:aws:iam::111122223333:user/pull-user-2"
+                    ]
+                },
+                "Action": [
+                    "ecr:BatchGetImage",
+                    "ecr:GetDownloadUrlForLayer"
+                ],
+                "Resource": "*"
+            },
+            {
+                "Sid": "AllowAll",
+                "Effect": "Allow",
+                "Principal": {
+                    "AWS": "arn:aws:iam::111122223333:user/admin-user"
+                },
+                "Action": [
+                    "ecr:*"
+                ],
+                "Resource": "*"
+            }
+        ]
+    }
+    
+
@@ -71,0 +146,24 @@ The following repository policy denies all users in all accounts the ability to
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Sid": "DenyPull",
+                "Effect": "Deny",
+                "Principal": "*",
+                "Action": [
+                    "ecr:BatchGetImage",
+                    "ecr:GetDownloadUrlForLayer"
+                ],
+                "Resource": "*"
+            }
+        ]
+    }
+    
+
@@ -110,0 +209,34 @@ The following repository policy allows AWS CodeBuild access to the Amazon ECR AP
+JSON
+    
+
+****
+    
+    
+    
+    {
+       "Version":"2012-10-17",		 	 	 
+       "Statement":[
+          {
+             "Sid":"CodeBuildAccess",
+             "Effect":"Allow",
+             "Principal":{
+                "Service":"codebuild.amazonaws.com"
+             },
+             "Action":[
+                "ecr:BatchGetImage",
+                "ecr:GetDownloadUrlForLayer"
+             ],
+             "Resource": "*",
+             "Condition":{
+                "ArnLike":{
+                   "aws:SourceArn":"arn:aws:codebuild:us-east-1:123456789012:project/project-name"
+                },
+                "StringEquals":{
+                   "aws:SourceAccount":"123456789012"
+                }
+             }
+          }
+       ]
+    }
+    
+