Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Sharing ECR repository within AWS organiztion

How can I share a repository in AWS ECR with all other accounts in organization? From what I have read here and elswere it seems like resource based permissions are the way to go. Namely it is suggested to add aws:PrincipalOrgID condition to a resource. However, when I use Account-A within organization to share the resource I still do not see that resource appearing in private repositories list in Account-B of the same organization. At this point I have exousted all the ideas and just don't understand how to move forward. I am very new to AWS.

Here is how my private repository is configured

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadonlyAccess",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:DescribeImageScanFindings",
        "ecr:DescribeImages",
        "ecr:DescribeRepositories",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetRepositoryPolicy",
        "ecr:ListImages"
      ],
      "Condition": {
        "StringLike": {
          "aws:PrincipalOrgID": "o-orgniztion"
        }
      }
    }
  ]
}
like image 850
Sergej Andrejev Avatar asked Oct 17 '25 15:10

Sergej Andrejev


1 Answers

According to This post you can use

"Condition": {
    "ForAnyValue:StringLike": {
       "aws:PrincipalOrgPaths":["o-xxxxxxxxxx/r-xxxx/ou-xxxx-xxxxxxxx/*"]
    }
}
like image 126
Mehmet Güngören Avatar answered Oct 20 '25 05:10

Mehmet Güngören