Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Elastic Container Registry

Amazon Elastic Container Registry (service prefix: ecr) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Elastic Container Registry
Actions defined by Amazon Elastic Container Registry
Permission-only actions for Amazon Elastic Container Registry
Resource types defined by Amazon Elastic Container Registry
Condition keys for Amazon Elastic Container Registry

API operations defined by Amazon Elastic Container Registry

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchCheckLayerAvailability	ecr:BatchCheckLayerAvailability			Read
BatchDeleteImage	ecr:BatchDeleteImage			Write
BatchGetImage	ecr:BatchGetImage			Read
	ecr:BatchImportUpstreamImage			Write
	ecr:CreateRepository			Write
	ecr:TagResource			Tagging, Write
BatchGetRepositoryScanningConfiguration	ecr:BatchGetRepositoryScanningConfiguration			Read
CompleteLayerUpload	ecr:CompleteLayerUpload			Write
CreatePullThroughCacheRule	ecr:CreatePullThroughCacheRule			Write
CreatePullThroughCacheRule	iam:PassRole	iam:PassedToService	ecr.amazonaws.com	Write
CreateRepository	ecr:CreateRepository			Write
CreateRepository	ecr:TagResource			Tagging, Write
CreateRepositoryCreationTemplate	ecr:CreateRepository			Write
	ecr:CreateRepositoryCreationTemplate			Write
	ecr:PutLifecyclePolicy			Write
	ecr:SetRepositoryPolicy			Permissions management, Write
	iam:PassRole	iam:PassedToService	ecr.amazonaws.com	Write
DeleteLifecyclePolicy	ecr:DeleteLifecyclePolicy			Write
DeletePullThroughCacheRule	ecr:DeletePullThroughCacheRule			Write
DeleteRegistryPolicy	ecr:DeleteRegistryPolicy			Permissions management, Write
DeleteRepository	ecr:DeleteRepository			Write
DeleteRepositoryCreationTemplate	ecr:DeleteRepositoryCreationTemplate			Write
DeleteRepositoryPolicy	ecr:DeleteRepositoryPolicy			Permissions management, Write
DeleteSigningConfiguration	ecr:DeleteSigningConfiguration			Write
DeregisterPullTimeUpdateExclusion	ecr:DeregisterPullTimeUpdateExclusion			Write
DescribeImageReplicationStatus	ecr:DescribeImageReplicationStatus			Read
DescribeImageScanFindings	ecr:DescribeImageScanFindings			Read
DescribeImageSigningStatus	ecr:DescribeImageSigningStatus			Read
DescribeImages	ecr:DescribeImages			List
DescribePullThroughCacheRules	ecr:DescribePullThroughCacheRules			List
DescribeRegistry	ecr:DescribeRegistry			Read
DescribeRepositories	ecr:DescribeRepositories			Read
DescribeRepositoryCreationTemplates	ecr:DescribeRepositoryCreationTemplates			Read
GetAccountSetting	ecr:GetAccountSetting			Read
GetAuthorizationToken	ecr:GetAuthorizationToken			Read
GetDownloadUrlForLayer	ecr:BatchImportUpstreamImage			Write
GetDownloadUrlForLayer	ecr:GetDownloadUrlForLayer			Read
GetLifecyclePolicy	ecr:GetLifecyclePolicy			Read
GetLifecyclePolicyPreview	ecr:GetLifecyclePolicyPreview			Read
GetRegistryPolicy	ecr:GetRegistryPolicy			Read
GetRegistryScanningConfiguration	ecr:GetRegistryScanningConfiguration			Read
GetRepositoryPolicy	ecr:GetRepositoryPolicy			Read
GetSigningConfiguration	ecr:GetSigningConfiguration			Read
InitiateLayerUpload	ecr:InitiateLayerUpload			Write
ListImageReferrers	ecr:BatchGetImage			Read
	ecr:BatchImportUpstreamImage			Write
	ecr:CreateRepository			Write
ListImages	ecr:ListImages			List
ListPullTimeUpdateExclusions	ecr:ListPullTimeUpdateExclusions			List
ListTagsForResource	ecr:ListTagsForResource			Read
PutAccountSetting	ecr:PutAccountSetting			Write
PutImage	ecr:PutImage			Write
PutImageScanningConfiguration	ecr:PutImageScanningConfiguration			Write
PutImageTagMutability	ecr:PutImageTagMutability			Write
PutLifecyclePolicy	ecr:PutLifecyclePolicy			Write
PutRegistryPolicy	ecr:PutRegistryPolicy			Permissions management, Write
PutRegistryScanningConfiguration	ecr:PutRegistryScanningConfiguration			Write
PutReplicationConfiguration	ecr:PutReplicationConfiguration			Write
PutSigningConfiguration	ecr:PutSigningConfiguration			Write
RegisterPullTimeUpdateExclusion	ecr:RegisterPullTimeUpdateExclusion			Write
SetRepositoryPolicy	ecr:SetRepositoryPolicy			Permissions management, Write
StartImageScan	ecr:StartImageScan			Write
StartLifecyclePolicyPreview	ecr:StartLifecyclePolicyPreview			Write
TagResource	ecr:TagResource			Tagging, Write
UntagResource	ecr:UntagResource			Tagging, Write
UpdateImageStorageClass	ecr:UpdateImageStorageClass			Write
UpdatePullThroughCacheRule	ecr:UpdatePullThroughCacheRule			Write
UpdatePullThroughCacheRule	iam:PassRole	iam:PassedToService	ecr.amazonaws.com	Write
UpdateRepositoryCreationTemplate	ecr:CreateRepository			Write
	ecr:PutLifecyclePolicy			Write
	ecr:SetRepositoryPolicy			Permissions management, Write
	ecr:UpdateRepositoryCreationTemplate			Write
	iam:PassRole	iam:PassedToService	ecr.amazonaws.com	Write
UploadLayerPart	ecr:UploadLayerPart			Write
ValidatePullThroughCacheRule	ecr:ValidatePullThroughCacheRule			Read

Actions defined by Amazon Elastic Container Registry

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchCheckLayerAvailability	Grants permission to check the availability of multiple image layers in a specified registry and repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
BatchDeleteImage	Grants permission to delete a list of specified images within a specified repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
BatchGetImage	Grants permission to get detailed information for specified images within a specified repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
BatchGetRepositoryScanningConfiguration	Grants permission to retrieve repository scanning configuration for a list of repositories	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
CompleteLayerUpload	Grants permission to inform Amazon ECR that the image layer upload for a specified registry, repository name, and upload ID, has completed	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
CreatePullThroughCacheRule	Grants permission to create new pull-through cache rule			Write
CreateRepository	Grants permission to create an image repository	repository*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecr:ResourceTag/${TagKey}	Write
CreateRepositoryCreationTemplate	Grants permission to create the repository creation template			Write
DeleteLifecyclePolicy	Grants permission to delete the specified lifecycle policy	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
DeletePullThroughCacheRule	Grants permission to delete the pull-through cache rule			Write
DeleteRegistryPolicy	Grants permission to delete the registry policy			Permissions management, Write
DeleteRepository	Grants permission to delete an existing image repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
DeleteRepositoryCreationTemplate	Grants permission to delete the repository creation template			Write
DeleteRepositoryPolicy	Grants permission to delete the repository policy from a specified repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Permissions management, Write
DeleteSigningConfiguration	Grants permission to delete the signing configuration for the registry			Write
DeregisterPullTimeUpdateExclusion	Grants permission to deregister a pull time update exclusion			Write
DescribeImageReplicationStatus	Grants permission to retrieve replication status about an image in a registry, including failure reason if replication fails	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
DescribeImageScanFindings	Grants permission to describe the image scan findings for the specified image	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
DescribeImageSigningStatus	Grants permission to retrieve signing status about an image in a specified registry	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
DescribeImages	Grants permission to get metadata about the images in a repository, including image size, image tags, and creation date	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	List
DescribePullThroughCacheRules	Grants permission to describe the pull-through cache rules			List
DescribeRegistry	Grants permission to describe the registry settings			Read
DescribeRepositories	Grants permission to describe image repositories in a registry	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
DescribeRepositoryCreationTemplates	Grants permission to describe the repository creation template			Read
GetAccountSetting	Grants permission to retrieve account settings		ecr:AccountSetting	Read
GetAuthorizationToken	Grants permission to retrieve a token that is valid for a specified registry for 12 hours			Read
GetDownloadUrlForLayer	Grants permission to retrieve the download URL corresponding to an image layer	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
GetLifecyclePolicy	Grants permission to retrieve the specified lifecycle policy	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
GetLifecyclePolicyPreview	Grants permission to retrieve the results of the specified lifecycle policy preview request	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
GetRegistryPolicy	Grants permission to retrieve the registry policy			Read
GetRegistryScanningConfiguration	Grants permission to retrieve registry scanning configuration			Read
GetRepositoryPolicy	Grants permission to retrieve the repository policy for a specified repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
GetSigningConfiguration	Grants permission to retrieve the signing configuration for the registry			Read
InitiateLayerUpload	Grants permission to notify Amazon ECR that you intend to upload an image layer	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
ListImages	Grants permission to list all the image IDs for a given repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	List
ListPullTimeUpdateExclusions	Grants permission to list pull time update exclusions for the registry			List
ListTagsForResource	Grants permission to list the tags for an Amazon ECR resource	repository*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecr:ResourceTag/${TagKey}	Read
PutAccountSetting	Grants permission to update account settings		ecr:AccountSetting	Write
PutImage	Grants permission to create or update the image manifest associated with an image	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
PutImageScanningConfiguration	Grants permission to update the image scanning configuration for a repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
PutImageTagMutability	Grants permission to update the image tag mutability settings for a repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
PutLifecyclePolicy	Grants permission to create or update a lifecycle policy	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
PutRegistryPolicy	Grants permission to update the registry policy			Permissions management, Write
PutRegistryScanningConfiguration	Grants permission to update registry scanning configuration			Write
PutReplicationConfiguration	Grants permission to update the replication configuration for the registry			Write
PutSigningConfiguration	Grants permission to update the signing configuration for the registry			Write
RegisterPullTimeUpdateExclusion	Grants permission to register a pull time update exclusion			Write
SetRepositoryPolicy	Grants permission to apply a repository policy on a specified repository to control access permissions	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Permissions management, Write
StartImageScan	Grants permission to start an image scan	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
StartLifecyclePolicyPreview	Grants permission to start a preview of the specified lifecycle policy	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag an Amazon ECR resource	repository*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecr:ResourceTag/${TagKey}	Tagging, Write
UntagResource	Grants permission to untag an Amazon ECR resource	repository*	aws:ResourceTag/${TagKey} aws:TagKeys ecr:ResourceTag/${TagKey}	Tagging, Write
UpdateImageStorageClass	Grants permission to get update the storage class of a specified image within a specified repository	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
UpdatePullThroughCacheRule	Grants permission to update the pull-through cache rule			Write
UpdateRepositoryCreationTemplate	Grants permission to update the repository creation template			Write
UploadLayerPart	Grants permission to upload an image layer part to Amazon ECR	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
ValidatePullThroughCacheRule	Grants permission to validate the pull-through cache rule			Read

Permission-only actions for Amazon Elastic Container Registry

The following actions are defined by Amazon Elastic Container Registry but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchImportUpstreamImage	Grants permission to retrieve the image from the upstream registry and import it to your private registry	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write
GetImageCopyStatus	Grants permission to retrieve the status about an image copy	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Read
ReplicateImage	Grants permission to replicate images to the destination registry	repository*	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}	Write

Actions

Description

Resource types (*required)

Condition keys

Access level

BatchImportUpstreamImage

Grants permission to retrieve the image from the upstream registry and import it to your private registry

repository*

aws:ResourceTag/${TagKey}

ecr:ResourceTag/${TagKey}

Write

GetImageCopyStatus

Grants permission to retrieve the status about an image copy

repository*

aws:ResourceTag/${TagKey}

ecr:ResourceTag/${TagKey}

Read

ReplicateImage

Grants permission to replicate images to the destination registry

repository*

aws:ResourceTag/${TagKey}

ecr:ResourceTag/${TagKey}

Write

Resource types defined by Amazon Elastic Container Registry

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
repository	arn:${Partition}:ecr:${Region}:${Account}:repository/${RepositoryName}	aws:ResourceTag/${TagKey} ecr:ResourceTag/${TagKey}

Resource types

ARN

Condition keys

repository

arn:${Partition}:ecr:${Region}:${Account}:repository/${RepositoryName}

aws:ResourceTag/${TagKey}

ecr:ResourceTag/${TagKey}

Condition keys for Amazon Elastic Container Registry

Amazon Elastic Container Registry defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters access by tag-value associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the request	ArrayOfString
ecr:AccountSetting	Filters access by the ECR account setting name	String
ecr:ResourceTag/${TagKey}	Filters access by tag-value associated with the resource	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Elastic Block Store (ebs)

Amazon Elastic Container Service (ecs)