与 Amazon SDK或SetRepositoryPolicy一起使用 CLI - Amazon ECR
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅 中国的 Amazon Web Services 服务入门 (PDF)

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

与 Amazon SDK或SetRepositoryPolicy一起使用 CLI

以下代码示例演示如何使用 SetRepositoryPolicy

操作示例是大型程序的代码摘录,必须在上下文中运行。在以下代码示例中,您可以查看此操作的上下文:

CLI
Amazon CLI

为存储库设置存储库策略

以下set-repository-policy示例将文件中包含的存储库策略附加到cluster-autoscaler存储库。

aws ecr set-repository-policy \ --repository-name cluster-autoscaler \ --policy-text file://my-policy.json

my-policy.json 的内容:

{ "Version" : "2008-10-17", "Statement" : [ { "Sid" : "allow public pull", "Effect" : "Allow", "Principal" : "*", "Action" : [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer" ] } ] }

输出:

{ "registryId": "012345678910", "repositoryName": "cluster-autoscaler", "policyText": "{\n \"Version\" : \"2008-10-17\",\n \"Statement\" : [ {\n \"Sid\" : \"allow public pull\",\n \"Effect\" : \"Allow\",\n \"Principal\" : \"*\",\n \"Action\" : [ \"ecr:BatchCheckLayerAvailability\", \"ecr:BatchGetImage\", \"ecr:GetDownloadUrlForLayer\" ]\n } ]\n}" }
Java
SDK适用于 Java 2.x
注意

还有更多相关信息 GitHub。查找完整示例,学习如何在 Amazon 代码示例存储库中进行设置和运行。

/** * Sets the repository policy for the specified ECR repository. * * @param repoName the name of the ECR repository. * @param iamRole the IAM role to be granted access to the repository. * @throws RepositoryPolicyNotFoundException if the repository policy does not exist. * @throws EcrException if there is an unexpected error setting the repository policy. */ public void setRepoPolicy(String repoName, String iamRole) { /* This example policy document grants the specified AWS principal the permission to perform the `ecr:BatchGetImage` action. This policy is designed to allow the specified principal to retrieve Docker images from the ECR repository. */ String policyDocumentTemplate = """ { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "new statement", "Effect" : "Allow", "Principal" : { "AWS" : "%s" }, "Action" : "ecr:BatchGetImage" } ] } """; String policyDocument = String.format(policyDocumentTemplate, iamRole); SetRepositoryPolicyRequest setRepositoryPolicyRequest = SetRepositoryPolicyRequest.builder() .repositoryName(repoName) .policyText(policyDocument) .build(); CompletableFuture<SetRepositoryPolicyResponse> response = getAsyncClient().setRepositoryPolicy(setRepositoryPolicyRequest); response.whenComplete((resp, ex) -> { if (resp != null) { System.out.println("Repository policy set successfully."); } else { Throwable cause = ex.getCause(); if (cause instanceof RepositoryPolicyNotFoundException) { throw (RepositoryPolicyNotFoundException) cause; } else if (cause instanceof EcrException) { throw (EcrException) cause; } else { String errorMessage = "Unexpected error: " + cause.getMessage(); throw new RuntimeException(errorMessage, cause); } } }); response.join(); }
  • 有关API详细信息,请参阅 “Amazon SDK for Java 2.x API参考 SetRepositoryPolicy” 中的。

Kotlin
SDK对于 Kotlin 来说
注意

还有更多相关信息 GitHub。查找完整示例,学习如何在 Amazon 代码示例存储库中进行设置和运行。

/** * Sets the repository policy for the specified ECR repository. * * @param repoName the name of the ECR repository. * @param iamRole the IAM role to be granted access to the repository. */ suspend fun setRepoPolicy( repoName: String?, iamRole: String?, ) { val policyDocumentTemplate = """ { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "new statement", "Effect" : "Allow", "Principal" : { "AWS" : "$iamRole" }, "Action" : "ecr:BatchGetImage" } ] } """.trimIndent() val setRepositoryPolicyRequest = SetRepositoryPolicyRequest { repositoryName = repoName policyText = policyDocumentTemplate } EcrClient { region = "us-east-1" }.use { ecrClient -> val response = ecrClient.setRepositoryPolicy(setRepositoryPolicyRequest) if (response != null) { println("Repository policy set successfully.") } } }

有关 Amazon SDK开发者指南和代码示例的完整列表,请参阅将 Amazon ECR 与 Amazon SDK。本主题还包括有关入门的信息以及有关先前SDK版本的详细信息。