使用BOTO3客户端更新ECR权限时出错

Question

我们正在尝试使用BOTO3 SDK更新ECR存储库的许可。

import json
import boto3

access_key = "*******"
secret_access = "*******"
ecr_repo_name = 'repo-name'

client = boto3.client('ecr', region_name="eu-west-1",
                      aws_access_key_id=access_key,
                      aws_secret_access_key=secret_access)

single_template = {
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "ECR_cross_account_access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<account_id>:root"
            },
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchGetImage",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ]
        }
    ]
}

response = client.put_registry_policy(policyText=json.dumps(single_template))
print(response)

我们遇到以下错误。

Traceback (most recent call last):
  File "miscs/update_ecr_policy.py", line 89, in <module>
    response = client.put_registry_policy(policyText=json.dumps(single_template))
  File "/home/nandha/projects/venv3/lib/python3.7/site-packages/botocore/client.py", line 401, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/home/nandha/projects/venv3/lib/python3.7/site-packages/botocore/client.py", line 731, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.errorfactory.InvalidParameterException: An error occurred (InvalidParameterException) when calling the PutRegistryPolicy operation: Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Invalid registry policy provided'

当我们使用AWS CLI命令提供相同的策略时，我们能够成功更新策略。

AWS ECR Set-Repository-Policy - Repository-name Repo_name-Policy-Text File：//policy.json

当我们使用Boto3 SDK更新以及如何修复它们时，该问题是什么问题？

Answer 1

我应该使用set_repository_policy来设置存储库策略。

import json
conv_policy_text = json.dumps(policy_json)
client.set_repository_policy(repositoryName=CURRENT_ECR_NAME, policyText=conv_policy_text)