ECR repository is publicly accessible

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: cloudformation-aws-ecr-repository-is-publicly-accessible

Provider: AWS

Platform: CloudFormation

Severity: Critical

Category: Access Control

Learn More

Description

Amazon ECR repository policies that allow wildcard principals (*) grant public access to container images, enabling any AWS account or unauthenticated user to pull or push images. This increases the risk of data exposure, unauthorized deployments, and supply-chain compromise.

The RepositoryPolicyText property of AWS::ECR::Repository resources must not contain Statement entries where Effect is Allow and the Principal includes *, unless the statement includes a Condition that genuinely scopes the caller — such as aws:PrincipalOrgID, aws:PrincipalAccount, or aws:SourceArn. Conditions that only restrict how a call is made (e.g. aws:SecureTransport) or check key presence (e.g. Null) are not considered scoping. This rule flags Allow statements whose Principal includes * and that are not scoped this way. Instead, specify explicit principals such as AWS account ARNs, IAM roles, or service principals, or restrict access with a scoping condition.

Secure configuration example (restrict to a specific AWS account):

MyRepository:
  Type: AWS::ECR::Repository
  Properties:
    RepositoryName: my-repo
    RepositoryPolicyText:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Principal:
            AWS: "arn:aws:iam::123456789012:root"
          Action:
            - "ecr:GetDownloadUrlForLayer"
            - "ecr:BatchGetImage"
            - "ecr:BatchCheckLayerAvailability"
          Resource: !Sub "arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/my-repo"

Compliant Code Examples

Resources:
  MyRepository1:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "test-repository"
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          -
            Sid: AllowPushPull
            Effect: Allow
            Principal:
              AWS:
                - "arn:aws:iam::123456789012:user/Bob"
                - "arn:aws:iam::123456789012:user/Alice"
            Action:
              - "ecr:GetDownloadUrlForLayer"
              - "ecr:BatchGetImage"
              - "ecr:BatchCheckLayerAvailability"
              - "ecr:PutImage"
              - "ecr:InitiateLayerUpload"
              - "ecr:UploadLayerPart"
              - "ecr:CompleteLayerUpload"

Resources:
  MyOrgRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "org-pull-repository"
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          -
            Sid: AllowOrgPull
            Effect: Allow
            Principal: "*"
            Action:
              - "ecr:BatchCheckLayerAvailability"
              - "ecr:BatchGetImage"
              - "ecr:GetDownloadUrlForLayer"
            Condition:
              StringEquals:
                "aws:PrincipalOrgID": "o-abc12defgh"

Non-Compliant Code Examples

Resources:
  MyRepository3:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "test-repository"
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          -
            Sid: AllowPushPull
            Effect: Allow
            Principal: "*"
            Action:
              - "ecr:GetDownloadUrlForLayer"
              - "ecr:BatchGetImage"
              - "ecr:BatchCheckLayerAvailability"
              - "ecr:PutImage"
              - "ecr:InitiateLayerUpload"
              - "ecr:UploadLayerPart"
              - "ecr:CompleteLayerUpload"

Resources:
  MyInsecureRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "secure-transport-only"
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          -
            Sid: AllowPullOverHttps
            Effect: Allow
            Principal: "*"
            Action:
              - "ecr:BatchCheckLayerAvailability"
              - "ecr:BatchGetImage"
              - "ecr:GetDownloadUrlForLayer"
            Condition:
              Bool:
                aws:SecureTransport: "true"

Resources:
  MyForAllValuesRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "forallvalues-org"
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          -
            Sid: AllowPullForAllOrgValues
            Effect: Allow
            Principal: "*"
            Action:
              - "ecr:BatchCheckLayerAvailability"
              - "ecr:BatchGetImage"
              - "ecr:GetDownloadUrlForLayer"
            Condition:
              ForAllValues:StringEquals:
                aws:PrincipalOrgID: "o-abc12defgh"