How can I share a repository in AWS ECR with all other accounts in organization? From what I have read here and elswere it seems like resource based permissions are the way to go. Namely it is suggested to add aws:PrincipalOrgID condition to a resource. However, when I use Account-A within organization to share the resource I still do not see that resource appearing in private repositories list in Account-B of the same organization. At this point I have exousted all the ideas and just don't understand how to move forward. I am very new to AWS.
Here is how my private repository is configured
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadonlyAccess",
"Effect": "Allow",
"Principal": "*",
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:DescribeImageScanFindings",
"ecr:DescribeImages",
"ecr:DescribeRepositories",
"ecr:GetAuthorizationToken",
"ecr:GetDownloadUrlForLayer",
"ecr:GetRepositoryPolicy",
"ecr:ListImages"
],
"Condition": {
"StringLike": {
"aws:PrincipalOrgID": "o-orgniztion"
}
}
}
]
}
According to This post you can use
"Condition": {
"ForAnyValue:StringLike": {
"aws:PrincipalOrgPaths":["o-xxxxxxxxxx/r-xxxx/ou-xxxx-xxxxxxxx/*"]
}
}
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With