ECR repository policies must not grant Allow permissions to the wildcard principal (*). This makes repositories publicly accessible and allows unauthorized accounts to pull or push container images, increasing the risk of data exposure and supply-chain compromise.
Check Ansible ECS/ECR tasks using the community.aws.ecs_ecr or ecs_ecr modules: in the resource policy document, any statement with "Effect": "Allow" and Principal equal to "*" is flagged unless it includes a Condition that genuinely scopes the caller — such as aws:PrincipalOrgID, aws:PrincipalAccount, or aws:SourceArn. Conditions that only restrict how a call is made (e.g. aws:SecureTransport) or check key presence (e.g. Null) are not considered scoping and the statement is still flagged. Instead, specify explicit principals such as AWS account ARNs, IAM role ARNs, or service principals, or restrict access using a scoping condition key.
Secure example with an explicit AWS account principal:
