我在 AWS 中添加了哪些权限以启用 ecr:getAuthorizationToken？

Question

I'm trying to follow the steps to use amazon elastic container registry (ECR) but I'm stuck at the first step, which is obtaining an auth token.

Command:

aws ecr get-login

Or...

aws ecr get-login --region=us-west-2

Error:

An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::9#####4:user/### is not authorized to perform: ecr:GetAuthorizationToken on resource: *

AWS Permissions on user for region us-west-2:

AmazonEC2FullAccess
AmazonEC2ContainerRegistryFullAccess
Billing
AdministratorAccess
AmazonECS_FullAccess 

AWS CLI version:

aws help --version
aws-cli/1.14.40 Python/3.6.4 Darwin/18.2.0 botocore/1.8.44

Answer 1

Please note that you're not allowing your user any access to ECR in a sense. Try adding the following policy to the user:

{
"Version": "2012-10-17",
"Statement": [{
    "Effect": "Allow",
    "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetRepositoryPolicy",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecr:DescribeImages",
        "ecr:BatchGetImage"
    ],
    "Resource": "*"
}]
}

https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html#AmazonEC2ContainerRegistryReadOnly

Answer 2

As general advice, ecr:GetAuthorizationToken must apparently be applied to all resources * but all other ECR permissions can be scoped. When setting up ECR permissions as below, that user/role can login into Docker via CLI and still only access those images that user/role is supposed to.

Example with scoped permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {           
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability",
        "ecr:CompleteLayerUpload",
        "ecr:GetDownloadUrlForLayer",
        "ecr:InitiateLayerUpload",
        "ecr:PutImage",
        "ecr:UploadLayerPart"
      ],
      "Resource": "arn:aws:ecr:${region}:${account}:repository/${repo-name}"
    },
    {
      "Effect": "Allow",
      "Action": "ecr:GetAuthorizationToken",
      "Resource": "*"
    }
  ]
}

From my observations, scoping ecr:GetAuthorizationToken to any ECR repositories will result in AccessDeniedException .