AWS lambda documentation change
Summary
Added 'ecr:BatchGetImage' and 'ecr:GetDownloadUrlForLayer' permissions to container image creation requirements
Security assessment
The change adds two required ECR permissions for Lambda container image creation but shows no evidence of addressing a specific vulnerability. It improves documentation completeness by specifying necessary permissions for container operations, which is security-related but not tied to a specific security issue.
Diff
diff --git a/lambda/latest/dg/images-create.md b/lambda/latest/dg/images-create.md index 2b73f7d65..774c740f1 100644 --- a//lambda/latest/dg/images-create.md +++ b//lambda/latest/dg/images-create.md @@ -173 +173 @@ Before you create a Lambda function from a container image, you must build the i -Make sure that the permissions for the user or role that creates the function includes `GetRepositoryPolicy` and `SetRepositoryPolicy`. +Make sure that the permissions for the user or role that creates the function includes `GetRepositoryPolicy`, `SetRepositoryPolicy`, `BatchGetImage`, and `GetDownloadUrlForLayer`. @@ -192 +192,3 @@ JSON - "ecr:GetRepositoryPolicy" + "ecr:GetRepositoryPolicy", + "ecr:BatchGetImage", + "ecr:GetDownloadUrlForLayer"