Community Note
- Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
Tell us about your request
Enable creating IAM policies (either against the resource or a principal) to allow restricting actions against certain image tags e.g. "Deny principals from the development account to reference images via the prod-* tag".
Which service(s) is this request for?
ECR
Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
We have a central ECR that stores all our images with cross account policies permitting access to pull images into those accounts.
An image would be uploaded to this repository with a tag like gc-${gitCommit}.
This image would then be promoted to rs-${env} e.g. rs-dev for the dev environments. It would then be promoted to rs-prd for the production environments (simplified version with fewer environments).
We would like to be able to restrict
- Accounts from access tags outside of their
rs-${env} name
- Users from pushing images to
gc-${commit} and non-rs-dev tags (i.e. production builds must go via CI)
Having the central registry allows us to very easily verify if two environments are using the same tag (rs-abc and rs-def would be pointing at the same manifest hash in ECR), separating the repositories between environments would mean we would have to build separate tooling to easily view that information.
Are you currently working around this issue?
We can't
Additional context
None
Attachments
None
Community Note
Tell us about your request
Enable creating IAM policies (either against the resource or a principal) to allow restricting actions against certain image tags e.g. "Deny principals from the development account to reference images via the
prod-*tag".Which service(s) is this request for?
ECR
Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
We have a central ECR that stores all our images with cross account policies permitting access to pull images into those accounts.
An image would be uploaded to this repository with a tag like
gc-${gitCommit}.This image would then be promoted to
rs-${env}e.g.rs-devfor the dev environments. It would then be promoted tors-prdfor the production environments (simplified version with fewer environments).We would like to be able to restrict
rs-${env}namegc-${commit}and non-rs-devtags (i.e. production builds must go via CI)Having the central registry allows us to very easily verify if two environments are using the same tag (
rs-abcandrs-defwould be pointing at the same manifest hash in ECR), separating the repositories between environments would mean we would have to build separate tooling to easily view that information.Are you currently working around this issue?
We can't
Additional context
None
Attachments
None