AWS AmazonECR documentation change
Summary
Removed detailed explanation of registry policy versions V1 and V2, simplified to state that Amazon ECR allows all ECR actions and enforces registry policy in all requests
Security assessment
This change simplifies the documentation by removing the distinction between V1 and V2 registry policy scopes. While it relates to permission management, there is no evidence of a security vulnerability being addressed. The change appears to be a documentation update reflecting current default behavior.
Diff
diff --git a/AmazonECR/latest/userguide/registry-permissions.md b/AmazonECR/latest/userguide/registry-permissions.md index 51c45738d..91457fc46 100644 --- a//AmazonECR/latest/userguide/registry-permissions.md +++ b//AmazonECR/latest/userguide/registry-permissions.md @@ -11,18 +11 @@ Amazon ECR uses a **registry policy** to grant permissions to an AWS principal a -The scope is set by choosing the registry policy version. There are two versions with different registry policy scope: version 1 (V1) and version 2 (V2). V2 is the expanded registry policy scope that includes all ECR permissions. For the full list of API actions, see the _[Amazon ECR API Guide](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/Welcome.html) _. The V2 version is the default registry policy scope. For more information about viewing or setting your registry policy scope, see [Switching to the extended registry policy scope](./registry-permissions-account-settings.html). For information about general settings for your Amazon ECR private registry, see [Private registry settings in Amazon ECR](./registry-settings.html). - -The versions are detailed as follows. - - * **V1** – For version 1, Amazon ECR only enforces the following permissions at the private registry level. - - * `ecr:ReplicateImage` – Grants permission to another account, referred to as the source registry, to replicate its images to your registry. This is only used for cross-account replication. - - * `ecr:BatchImportUpstreamImage` – Grants permission to retrieve the external image and import it to your private registry. - - * `ecr:CreateRepository` – Grants permission to create a repository in a private registry. This permission is required if the repository storing either the replicated or cached images doesn't already exist in the private registry. - - * **V2** – For version 2, Amazon ECR allows all ECR actions in the policy and enforces the registry policy in all ECR requests. - - - - -You can use the console or the CLI to view or change your registry policy scope. +Amazon ECR allows all ECR actions in the policy and enforces the registry policy in all ECR requests. You can use registry policies to grant permissions for actions such as replication configuration, pull-through cache rule creation, and repository creation. For the full list of API actions, see the _[Amazon ECR API Guide](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/Welcome.html) _. For information about general settings for your Amazon ECR private registry, see [Private registry settings in Amazon ECR](./registry-settings.html). @@ -38,2 +20,0 @@ While it is possible to add the `ecr:*` action to a private registry policy, it - * [Switching to the extended registry policy scope](./registry-permissions-account-settings.html) -