Our CD infrastructure deploys Docker images to our ECR repositories. In each repository, there's a latest tag, which is what runs when you (re)start that service.
I'd like to be able to grant IAM users permission to change which deployed image is used by setting the latest tag to another image in the repository, e.g. to roll back to an earlier version after a bad deploy.
The AWS ECR docs for Retagging an image say that you do so by calling aws ecr put-image, but I don't want to enable people to upload arbitrary images of their own devising, just to choose which of the images that came through CD is latest.
It seems like I can grant ecr:PutImage without ecr:InitiateLayerUpload / ecr:CompleteLayerUpload, but it seems like Amazon docs aren't targeting this use case, so I find it tricky to work out what powers this actually grants. What can someone do with the ability to set arbitrary image manifests, if they can't upload images themselves? Or is there some other way to allow people to set tags but do nothing else?