amazon-web-services - 有没有办法在我的组织或不同帐户之间共享我的 ECR 存储库？

Question

我希望在启用了跨账户策略的账户中无需单独推送来实现此目的。有没有办法在其他帐户的 lambda 函数中提及图像 uri 路径，以便它从原始帐户获取我的 docker 图像。

我的图像已经驻留在其中一个帐户中，我们将其称为 ACC A。现在我想在 ACC B 中使用相同的存储库，而不必在 ACC B 中再次推送该图像。

Answer 1

当我需要允许组织内的所有帐户进行访问时，我通常会对 ECR 或 S3 等服务使用基于资源的策略。

这是通过使用“AWS:PrincipalOrgID” IAM 条件来实现的，下面是它的只读访问示例。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ReadonlyAccess",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchGetImage",
                "ecr:DescribeImageScanFindings",
                "ecr:DescribeImages",
                "ecr:DescribeRepositories",
                "ecr:GetAuthorizationToken",
                "ecr:GetDownloadUrlForLayer",
                "ecr:GetRepositoryPolicy",
                "ecr:ListImages"
            ],
            "Condition": {
                "StringLike": {
                    "aws:PrincipalOrgID": "<YOUR-ORGANIZATION-ID>"
                }
            }
        }
    ]
}

这里是完整的 Terraform 相当于如何实现这一点

resource "aws_ecr_repository" "example" {
  name = "example"
}

data "aws_iam_policy_document" "ecr_readonly_access" {
  statement {
    sid    = "ReadonlyAccess"
    effect = "Allow"

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "StringLike"
      variable = "aws:PrincipalOrgID"
      # This is our organization-wide identifier which can be found after
      # log-in to AWS: <https://console.aws.amazon.com/organizations/home>
      values = [aws_organizations_organization.this.id]
    }

    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetRepositoryPolicy",
      "ecr:DescribeRepositories",
      "ecr:ListImages",
      "ecr:DescribeImages",
      "ecr:BatchGetImage",
      "ecr:DescribeImageScanFindings",
    ]
  }
}

resource "aws_ecr_repository_policy" "ecr" {
  repository = aws_ecr_repository.example.name
  policy     = data.aws_iam_policy_document.ecr_readonly_access.json
}