Amazon ECR
用户指南 (API 版本 2015-09-21)
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

Amazon Elastic Container Registry 基于身份的策略示例

默认情况下,IAM 用户和角色没有创建或修改 Amazon ECR 资源的权限。它们还无法使用 AWS 管理控制台、AWS CLI 或 AWS API 执行任务。IAM 管理员必须创建 IAM 策略,为用户和角色授予权限,以便对他们所需的指定资源执行特定的 API 操作。然后,管理员必须将这些策略附加到需要这些权限的 IAM 用户或组。

要了解如何使用这些示例 JSON 策略文档创建 IAM 基于身份的策略,请参阅 IAM 用户指南 中的 JSON 选项卡上的创建策略

策略最佳实践

Identity-based policies are very powerful. They determine whether someone can create, access, or delete Amazon ECR resources in your account. These actions can incur costs for your AWS account. When you create or edit identity-based policies, follow these guidelines and recommendations:

  • Get Started Using AWS Managed Policies – To start using Amazon ECR quickly, use AWS managed policies to give your employees the permissions they need. These policies are already available in your account and are maintained and updated by AWS. For more information, see Get Started Using Permissions With AWS Managed Policies in the IAM 用户指南.

  • Grant Least Privilege – When you create custom policies, grant only the permissions required to perform a task. Start with a minimum set of permissions and grant additional permissions as necessary. Doing so is more secure than starting with permissions that are too lenient and then trying to tighten them later. For more information, see Grant Least Privilege in the IAM 用户指南.

  • Enable MFA for Sensitive Operations – For extra security, require IAM users to use multi-factor authentication (MFA) to access sensitive resources or API operations. For more information, see Using Multi-Factor Authentication (MFA) in AWS in the IAM 用户指南.

  • Use Policy Conditions for Extra Security – To the extent that it's practical, define the conditions under which your identity-based policies allow access to a resource. For example, you can write conditions to specify a range of allowable IP addresses that a request must come from. You can also write conditions to allow requests only within a specified date or time range, or to require the use of SSL or MFA. For more information, see IAM JSON Policy Elements: Condition in the IAM 用户指南.

使用 Amazon ECR 控制台

要访问 Amazon Elastic Container Registry 控制台,您必须拥有一组最低的权限。这些权限必须允许您列出和查看有关您的 AWS 账户中的 Amazon ECR 资源的详细信息。如果创建比必需的最低权限更为严格的基于身份的策略,对于附加了该策略的实体(IAM 用户或角色),控制台将无法按预期正常运行。

要确保这些实体仍然可以使用 Amazon ECR 控制台,请将 AmazonEC2ContainerRegistryReadOnlyAWS 托管策略附加到这些实体。有关更多信息,请参阅 IAM 用户指南 中的为用户添加权限

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:DescribeImages", "ecr:BatchGetImage" ], "Resource": "*" }] }

对于仅调用 AWS CLI 或 AWS API 的用户,您不需要允许最低控制台权限。相反,只允许访问与您尝试执行的 API 操作相匹配的操作。

允许用户查看他们自己的权限

This example shows how you might create a policy that allows IAM users to view the inline and managed policies that are attached to their user identity. This policy includes permissions to complete this action on the console or programmatically using the AWS CLI or AWS API.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ViewOwnUserInfo", "Effect": "Allow", "Action": [ "iam:GetUserPolicy", "iam:ListGroupsForUser", "iam:ListAttachedUserPolicies", "iam:ListUserPolicies", "iam:GetUser" ], "Resource": [ "arn:aws-cn:iam::*:user/${aws:username}" ] }, { "Sid": "NavigateInConsole", "Effect": "Allow", "Action": [ "iam:GetGroupPolicy", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:ListAttachedGroupPolicies", "iam:ListGroupPolicies", "iam:ListPolicyVersions", "iam:ListPolicies", "iam:ListUsers" ], "Resource": "*" } ] }

访问一个 Amazon ECR 存储库

在此示例中,您想要为您的 AWS 账户中的 IAM 用户授予访问其中一个 Amazon ECR 存储库 (my-repo) 的权限。您还希望允许用户推送、拉取和列出映像。

{ "Version":"2012-10-17", "Statement":[ { "Sid":"ListImagesInRepository", "Effect":"Allow", "Action":[ "ecr:ListImages" ], "Resource":"arn:aws-cn:ecr:us-east-1:123456789012:repository/my-repo" }, { "Sid":"ManageRepositoryContents", "Effect":"Allow", "Action":[ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:DescribeImages", "ecr:BatchGetImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage" ], "Resource":"arn:aws-cn:ecr:us-east-1:123456789012:repository/my-repo" } ] }