ECR private repositories should not grant public image uploads

ecr
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Identify when Amazon Elastic Container Repositories container images can be created or overwritten by anyone.

Rationale

Publicly accessible Amazon Elastic Container Repositories (ECR) allows unauthorized users access to private container image repositories. This can lead to tampering with mutable container images potentially leading to unauthorized access to infrastructure or data.

Remediation

  1. First, retrieve the current policy of the repository. Replace , , and with your actual values:
    aws ecr get-repository-policy --region <region> --registry-id <account-id> --repository-name <repository-name>
  2. Open the policy.json file in a text editor. Look for the statement that grants public access (the one with “Principal”: “*”) and remove it.
  3. After editing the policy, apply the updated policy to the repository:
        aws ecr set-repository-policy --region <region> --registry-id <account-id> --repository-name <repository-name> --policy-text file://policy.json