AWS Lambda from cross account ECR : Lambda does not have permission to access the ECR image

user_10196164 0
Viewed 951

I'm trying to create a lambda function in account B from an ECR Image from another account A but i'm encountering a Lambda does not have permission to access the ECR image error.

I created the following ECR policy following this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CrossAccountPermission",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::BBBBBBBBBBBB:root"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Condition": {
        "StringLike": {
          "aws:sourceArn:": "arn:aws:lambda:eu-west-1:BBBBBBBBBBBB:function:*"
        }
      }
    }
  ]
}

I'm using aws sso assumed role to perform the lambda creation, i don't know if this has an impact.

Account B and A are not in the same AWS Organization unit.

Things i tested :

  • If i remove the condition from the statement targeting the lambda service, the error goes away, but obviously it's not a permanent solution.
  • Running an ECS Task using the same ECR image in account B works fine.
  • I tried following the SAM tutorial here and i encountered the same issue.

I'm running out of things to check and i would really like to avoid copying the ECR image in account B.

Do you have any idea why the example policy doesn't seem to work ?

How can i narrow the policy from everything coming from the lambda service ? I was planning to use aws:PrincipalOrgPaths to allow multiple organization units but this doesn't seem to work with the lambda principal.

amazon-ecr aws-lambda amazon-web-services
3 Answers

I spent way too much time on this today so hopefully it helps someone else, but I finally was able to share images with entire org using the following repository policy...

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CrossOrgPermission",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Condition": {
        "StringLike": {
          "aws:PrincipalOrgID": "x-xxxxxxxxx"
        }
      }
    },
    {
      "Sid": "LambdaECRImageCrossOrgRetrievalPolicy",
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Condition": {
        "StringLike": {
          "aws:ResourceOrgID": "x-xxxxxxxxx"
        }
      }
    }
  ]
}

My CrossOrgPermission is a little more broad than what is here, but I believe it should still work as shown.

user_138804410

As I stated in my comment, it was a dumb typo, as is often the case with policies.

I used "aws:sourceArn:": instead of "aws:sourceArn": ...

user_101961640
user_193975620
Related