Create IAM Roles for ECR Access

Policy Configuration

1. In the AWS Console interface, search for and select IAM

2. In the right selection menu:

• Select Policies
• Click on Create policy

3. In the Policy Editor, search for and select Elastic Container Registry

4. A rule selection panel appears. In the List section:

• Select DescribeImage
• Select ListImages

5. In the Read section:

• Select BatchGetImage
• Select DescribeRegistry
• Select DescribeRepositories
• Select GetAccountSetting
• Select GetAuthorizationToken

6. In the Resources section:

• Select Specific
• Select Any in this account
• Click Next

7. In the Policy details section:

• Policy name: ReadECRRepositoryContent
• Description: Allow pull images, describe repositories
• Click Create policy

8. Similarly, we will create an additional policy for writing to ECR by clicking Create Policy:

9. A rule selection panel appears:

• In the Read section:

  • Select BatchCheckLayerAvailability
  • Select GetAuthorizationToken

• In the Write section:

  • Select CompleteLayerUpload
  • Select InitiateLayerUpload
  • Select PutImage
  • Select UploadLayerPart

10. In the Resources section:

• Select Specific
• Select Any in this account
• Click Next

11. The Policy details panel appears:

• Policy name: WriteECRRepositoryContent
• Description: Allow push and delete images
• Click Next and select Create policy

Create Role for ECR

1. In the EC2 management interface:

• Select Roles
• Click on Create role

2. In the Role details section:

• Trusted entity type: AWS service
• Use case: EC2
• Click Next

3. In the Permissions policies section:

• Select the two policies we just created: ReadECRRepositoryContent and WriteECRRepositoryContent
• Then we will click Next

4. In the Role details section:

• Role name: CustomRWECRRole
• Description: Custom Read and Write role ECS
• Click Create role