无法为 AWS ECR 创建策略

Question

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPushPull",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<account_id>:user/root"
            },
            "Action": [
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ],
            "Resource": [
                "xxx.dkr.ecr.us-west-2.amazonaws.com/yyy"
            ]
        }
    ]
}

我尝试使用的命令是：

aws ecr set-repository-policy --repository-name yyy --policy-text file://ecr-policy.json

如果我在 Linux 计算机中执行 ls ，我可以在运行此命令的同一文件夹中看到此 ecr-policy.json 。

我想授予我自己访问权限。

我总是收到错误：

调用 SetRepositoryPolicy 操作时发生错误 (InvalidParameterException)：“PolicyText”处的无效参数无法满足约束：“提供的存储库策略无效”

我检查了我的 AWS ARN，它以 root 结尾。

Answer 1

我想向自己授予访问权限。

您不需要资源部分，因为此语句将附加到特定存储库。尝试在 Console > 添加以下语句： ECR> 存储库 > [在Images表上选择一个存储库]> 权限：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPushPull",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::<account #>:user/<your IAM user name>",
                    "arn:aws:iam::<account #>:root"
                ]
            },
            "Action": [
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ]
        }
    ]
}

注意：替换<帐户#>使用您的 AWS 账户 ID。

Answer 2

删除策略 json 文件中的 Resource

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPushPull",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<account_id>:user/root"
            },
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchDeleteImage",
                "ecr:BatchGetImage",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:ListImages",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ]
        }
    ]
}

或者您可以在 AWS 控制台上设置

1. 转到 Amazon ECR >存储库
2. 创建存储库
3. 单击您创建的存储库
4. 并转到权限 选项卡
5. 编辑权限 ->输入上面的json文件

Answer 3

尝试以下格式的资源：

arn:${Partition}:ecr:${Region}:${Account}:repository/${Repository-name}

https://docs。 aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html