Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs(ecr-assets): fixes documentation for cross-account access to dockerImageAsset ECR repository #29766

Merged
merged 3 commits into from
Apr 8, 2024
Merged

docs(ecr-assets): fixes documentation for cross-account access to dockerImageAsset ECR repository #29766

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
04fd2f9
Improves documentation for issue in #13327
nickgardner-amazon Apr 8, 2024
87574b2
Merge branch 'main' into fix-ecr-assets-docs
nickgardner-amazon Apr 8, 2024
d9c4d2b
Merge branch 'main' into fix-ecr-assets-docs
mergify[bot] Apr 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions packages/aws-cdk-lib/aws-ecr-assets/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,8 +207,7 @@ method. This will modify the IAM policy of the principal to allow it to
pull images from this repository.

If the pulling principal is not in the same account or is an AWS service that
doesn't assume a role in your account (e.g. AWS CodeBuild), pull permissions
must be granted on the __resource policy__ (and not on the principal's policy).
To do that, you can use `asset.repository.addToResourcePolicy(statement)` to
grant the desired principal the following permissions: "ecr:GetDownloadUrlForLayer",
doesn't assume a role in your account (e.g. AWS CodeBuild), you must either copy the image to a new repository, or
grant pull permissions on the resource policy of the repository. Since the repository is managed by the CDK bootstrap stack,
the following permissions must be granted there, or granted manually on the repository: "ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage" and "ecr:BatchCheckLayerAvailability".