Elastic Container Registry
Prefix ecr, 65 actions · Domain Containers
18 AWS managed policies. 4 have reviewed guidance; the rest have authoritative permission data pending editorial review. 4 are service-linked role policies, shown with permission data only.
User access (3)
Operator and limited (6)
Service roles (5)
Service-linked roles (4)
Also grants Elastic Container Registry actions (58)
- AccessAnalyzerServiceRolePolicy
- AdministratorAccess
- AdministratorAccess-Amplify
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonBraketFullAccess
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonDataZoneSageMakerManageAccessRolePolicy
- AmazonEKSLocalOutpostClusterPolicy
- AmazonInspector2ServiceRolePolicy
- AmazonRedshiftAllCommandsFullAccess
- AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
- AmazonSageMakerCanvasFullAccess
- AmazonSageMakerFullAccess
- AmazonSageMakerHyperPodInferenceAccess
- AmazonSageMakerModelCustomizationCoreAccess
- AmazonSageMakerModelRegistryFullAccess
- AmazonSageMakerReadOnly
- AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy
- AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSCleanRoomsMLFullAccess
- AWSCODAPermissionsBoundary
- AWSCodeBuildAdminAccess
- AWSCodePipeline_FullAccess
- AWSConfigServiceRolePolicy
- AWSContinuumCollectorServiceRolePolicy
- AWSElasticBeanstalkServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSRoboMaker_FullAccess
- AWSSecurityHubV2ServiceRolePolicy
- AWSServiceRoleForImageBuilder
- AWSSupportServiceRolePolicy
- AWSTransformApplicationECSDeploymentPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- BedrockAgentCoreFullAccess
- CloudWatchOmniAWSIntegrationPolicy
- EC2ImageBuilderExecutionPolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecurityAudit
- SupportUser
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
batchchecklayeravailability batchdeleteimage batchgetimage batchgetrepositoryscanningconfiguration batchimportupstreamimage completelayerupload createpullthroughcacherule createrepository createrepositorycreationtemplate deletelifecyclepolicy deletepullthroughcacherule deleteregistrypolicy deleterepository deleterepositorycreationtemplate deleterepositorypolicy deletesigningconfiguration deregisterpulltimeupdateexclusion describeimagereplicationstatus describeimagescanfindings describeimagesigningstatus describeimages describepullthroughcacherules describeregistry describereplicationbackfillresults describerepositories describerepositorycreationtemplates getaccountsetting getauthorizationtoken getdownloadurlforlayer getimagecopystatus getlifecyclepolicy getlifecyclepolicypreview getregistrypolicy getregistryscanningconfiguration getrepositorypolicy getsigningconfiguration initiatelayerupload listimages listpulltimeupdateexclusions listreplicationbackfills listtagsforresource putaccountsetting putimage putimagescanningconfiguration putimagetagmutability putlifecyclepolicy putregistrypolicy putregistryscanningconfiguration putreplicationconfiguration putsigningconfiguration registerpulltimeupdateexclusion replicateimage replicateimagedelete setrepositorypolicy startimagescan startlifecyclepolicypreview startreplicationbackfill stopreplicationbackfill tagresource untagresource updateimagestorageclass updatepullthroughcacherule updaterepositorycreationtemplate uploadlayerpart validatepullthroughcacherule
Actions (65)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| ecr:BatchCheckLayerAvailability | Read | 24 | 10 |
| ecr:BatchDeleteImage | Write | 5 | 8 |
| ecr:BatchGetImage | Read | 28 | 13 |
| ecr:BatchGetRepositoryScanningConfiguration | Read | 12 | 2 |
| ecr:BatchImportUpstreamImage | Write | 6 | 2 |
| ecr:CompleteLayerUpload | Write | 7 | 9 |
| ecr:CreatePullThroughCacheRule | Write | 5 | 1 |
| ecr:CreateRepository | Write | 8 | 12 |
| ecr:CreateRepositoryCreationTemplate | Write | 5 | 1 |
| ecr:DeleteLifecyclePolicy | Write | 5 | 2 |
| ecr:DeletePullThroughCacheRule | Write | 5 | 1 |
| ecr:DeleteRegistryPolicy | Permissions management | 5 | 1 |
| ecr:DeleteRepository | Write | 5 | 7 |
| ecr:DeleteRepositoryCreationTemplate | Write | 5 | 1 |
| ecr:DeleteRepositoryPolicy | Permissions management | 5 | 5 |
| ecr:DeleteSigningConfiguration | Write | 5 | 1 |
| ecr:DeregisterPullTimeUpdateExclusion | Write | 5 | 1 |
| ecr:DescribeImageReplicationStatus | Read | 16 | 1 |
| ecr:DescribeImageScanFindings | Read | 18 | 2 |
| ecr:DescribeImageSigningStatus | Read | 15 | 1 |
| ecr:DescribeImages | List | 28 | 8 |
| ecr:DescribePullThroughCacheRules | List | 18 | 3 |
| ecr:DescribeRegistry | Read | 23 | 3 |
| ecr:DescribeReplicationBackfillResults | Read | 14 | 1 |
| ecr:DescribeRepositories | Read | 31 | 9 |
| ecr:DescribeRepositoryCreationTemplates | Read | 18 | 3 |
| ecr:GetAccountSetting | Read | 9 | 1 |
| ecr:GetAuthorizationToken | Read | 34 | 5 |
| ecr:GetDownloadUrlForLayer | Read | 28 | 12 |
| ecr:GetImageCopyStatus | Read | 7 | 2 |
| ecr:GetLifecyclePolicy | Read | 16 | 5 |
| ecr:GetLifecyclePolicyPreview | Read | 10 | 1 |
| ecr:GetRegistryPolicy | Read | 15 | 3 |
| ecr:GetRegistryScanningConfiguration | Read | 13 | 3 |
| ecr:GetRepositoryPolicy | Read | 19 | 6 |
| ecr:GetSigningConfiguration | Read | 8 | 2 |
| ecr:InitiateLayerUpload | Write | 7 | 9 |
| ecr:ListImages | List | 19 | 7 |
| ecr:ListPullTimeUpdateExclusions | List | 11 | 2 |
| ecr:ListReplicationBackfills | List | 10 | 1 |
| ecr:ListTagsForResource | Read | 17 | 8 |
| ecr:PutAccountSetting | Write | 5 | 1 |
| ecr:PutImage | Write | 7 | 9 |
| ecr:PutImageScanningConfiguration | Write | 5 | 2 |
| ecr:PutImageTagMutability | Write | 5 | 2 |
| ecr:PutLifecyclePolicy | Write | 5 | 3 |
| ecr:PutRegistryPolicy | Permissions management | 5 | 1 |
| ecr:PutRegistryScanningConfiguration | Write | 6 | 1 |
| ecr:PutReplicationConfiguration | Write | 5 | 1 |
| ecr:PutSigningConfiguration | Write | 5 | 1 |
| ecr:RegisterPullTimeUpdateExclusion | Write | 5 | 1 |
| ecr:ReplicateImage | Write | 6 | 1 |
| ecr:ReplicateImageDelete | Write | 6 | 1 |
| ecr:SetRepositoryPolicy | Permissions management | 5 | 5 |
| ecr:StartImageScan | Write | 7 | 1 |
| ecr:StartLifecyclePolicyPreview | Write | 5 | 1 |
| ecr:StartReplicationBackfill | Write | 5 | 1 |
| ecr:StopReplicationBackfill | Write | 5 | 1 |
| ecr:TagResource | Tagging | 6 | 10 |
| ecr:UntagResource | Tagging | 6 | 6 |
| ecr:UpdateImageStorageClass | Write | 5 | 1 |
| ecr:UpdatePullThroughCacheRule | Write | 5 | 1 |
| ecr:UpdateRepositoryCreationTemplate | Write | 5 | 1 |
| ecr:UploadLayerPart | Write | 7 | 9 |
| ecr:ValidatePullThroughCacheRule | Read | 5 | 1 |