如何匿名从 AWS ECR docker 镜像中提取？

Question

I understand we need to login to ECR to pull docker image from AWS ECR. How can I make it anonymous? Since we separate code, data and infrastructure (all open source) separate we do not find a need for the infrastructure part to be private.

I was able to find the way to create permission with *, not sure how can I make it anonymous so that anyone who wants to download does not need an IAM user access.

Below is the policy,

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowPublic",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ]
        }
    ]
}

Not sure how can I create an anonymous IAM user as well.

Answer 1

If you read the FAQ

Q: Can Amazon ECR host public container images?

Amazon ECR currently supports private images. However, using IAM resource-based permissions, you can configure policies for each repository to allow access to IAM users, roles, or other AWS accounts.

The only workaround I can think of is probably putting a EC2 machine and the using NGINX to proxy_pass to the ECR url and using the EC2 IP for docker repo

Answer 2

Starting 1 Dec 2020, You can use ECR public to pull container images anonymously.

Links to How To & Launch Announcement

Anyone who pulls images anonymously gets 500 GB of free data bandwidth each month after which they can sign up for or sign in to an AWS account. Simply authenticating with an AWS account increases free data bandwidth to 5 TB each month when pulling images from the internet. And finally, workloads running in AWS will get unlimited data bandwidth from any region when pulling from ECR Public.