AWS AmazonECR medium security documentation change

Service: AmazonECR · 2026-01-28 · Security-related medium

File: AmazonECR/latest/userguide/blob-mounting.md

Summary

Added IAM permission requirement note for ecr:GetDownloadUrlForLayer to perform blob mounting

Security assessment

Explicitly documents required IAM permission for a security-sensitive operation (blob mounting). Missing this permission could cause operational failures and potential security issues if misconfigured. The change directly addresses access control requirements.

Diff

diff --git a/AmazonECR/latest/userguide/blob-mounting.md b/AmazonECR/latest/userguide/blob-mounting.md
index 6b93a0095..feae18247 100644
--- a//AmazonECR/latest/userguide/blob-mounting.md
+++ b//AmazonECR/latest/userguide/blob-mounting.md
@@ -33,0 +34,4 @@ You can use the AWS Management Console or AWS CLI to configure blob mounting for
+###### Note
+
+Users need `ecr:GetDownloadUrlForLayer` IAM permission on a repository to mount layers from it.
+