Create IAM Roles for ECR Access
Policy Configuration
In the AWS Console interface:
- Search for and select
IAM

In the right selection menu:
- Select Policy
- Click on Create Policy

In the Policy Editor:
- Search for and select Elastic Container Registry
- Click Next

A rule selection panel appears:
- In the List section:
- Select DescribeImage
- Select ListImages
- In the Read section:
- Select BatchGetImage
- Select DescribeRegistry
- Select DescribeRepositories
- Select GetAccountSetting
- Select GetAuthorizationToken

- In the Resources section:
- Select Specific
- Select Any in this account
- Click Next

In the Policy details section:
- Policy name:
ReadECRRepositoryContent
- Description:
Allow pull images, describe repositories


Similarly, we will create an additional policy for writing to ECR:
A rule selection panel appears:
- In the Read section:
- Select BatchCheckLayerAvailability
- Select GetAuthorizationToken
- In the Write section:
- Select CompleteLayerUpload
- Select InitialLayerUpload
- Select PutImage
- Select UploadLayerPart

- In the Resources section:
- Select Any in this account
- Click Next

The Policy details panel appears:
- Policy name:
WriteECRRepositoryContent
- Description:
Allow push and delete images


Create Role for ECR
In the EC2 management interface:
- Select Roles
- Click on Create role

- Select AWS service
- Choose EC2


- Filter by Type: Customer managed
- Select the two policies we just created
- Click Next

In the Role details section:
- Role name:
CustomRWECRRole
- Description:
Custom Read and Write role for ECS

