---
title: ECR private repositories should not grant public image downloads
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > ECR private repositories should not
  grant public image downloads
---

# ECR private repositories should not grant public image downloads
 
## Description{% #description %}

Identify when Amazon Elastic Container Repositories container images can be downloaded by anyone.

## Rationale{% #rationale %}

Publicly accessible Amazon Elastic Container Repositories (ECR) allows unauthorized users access to private container image repositories. Allowing the ability to download private images can lead to source code, secrets, or other sensitive information being exposed to unauthorized users.

## Remediation{% #remediation %}

1. First, retrieve the current policy of the repository. Replace,, andwith your actual values:
   ```
   aws ecr get-repository-policy --region <region> --registry-id <account-id> --repository-name <repository-name>
   ```
1. Open the policy.json file in a text editor. Look for the statement that grants public access (the one with "Principal": "*") and remove it.
1. After editing the policy, apply the updated policy to the repository:
   ```
       aws ecr set-repository-policy --region <region> --registry-id <account-id> --repository-name <repository-name> --policy-text file://policy.json 
   ```