title: "Invalid registry policy provided" when trying to create ECR cross account permissions
body: <p>I've been trying to allow one account to pull images from another account's ECR. This is my Terraform:</p>
  <pre><code>resource &quot;aws_ecr_repository&quot; &quot;repos&quot; {
    for_each = var.repos
  
    name = each.value
  }
  
  
  resource &quot;aws_ecr_registry_policy&quot; &quot;cross_account&quot; {
    policy = data.aws_iam_policy_document.allow_cross_account_pull.json
  }
  
  data &quot;aws_iam_policy_document&quot; &quot;allow_cross_account_pull&quot; {
    statement {
      sid = &quot;AllowCrossAccountPull&quot;
      effect = &quot;Allow&quot;
      principals {
        type = &quot;AWS&quot;
        identifiers = [
          for account in var.allowed_accounts : &quot;arn:aws:iam::${account}:role/*&quot;
        ]
      }
      actions = [
        &quot;ecr:BatchGetImage&quot;,
        &quot;ecr:BatchCheckLayerAvailability&quot;,
        &quot;ecr:GetDownloadUrlForLayer&quot;,
        &quot;ecr:GetAuthorizationToken&quot;,
      ]
      resources = [for repo in resource.aws_ecr_repository.repos : &quot;${repo.arn}&quot;]
    }
  }
  </code></pre>
  <p>I already tried <code>role/*</code>, <code>root</code>, and <code>*</code>, because I thought that it could be a problem with <code>identifiers</code>. It didn't work.</p>
  <p>This is the error I get:</p>
  <pre><code>aws_ecr_registry_policy.cross_account: Creating...
  ╷
  │ Error: Error creating ECR Registry Policy: InvalidParameterException: Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Invalid registry policy provided'
  │ 
  │   with aws_ecr_registry_policy.cross_account,
  │   on main.tf line 8, in resource &quot;aws_ecr_registry_policy&quot; &quot;cross_account&quot;:
  │    8: resource &quot;aws_ecr_registry_policy&quot; &quot;cross_account&quot; {
  </code></pre>
  <p>This is the result of a <code>terraform plan</code>:</p>
  <pre><code>Terraform will perform the following actions:
  
    # aws_ecr_registry_policy.cross_account will be created
    + resource &quot;aws_ecr_registry_policy&quot; &quot;cross_account&quot; {
        + id          = (known after apply)
        + policy      = jsonencode(
              {
                + Statement = [
                    + {
                        + Action    = [
                            + &quot;ecr:GetDownloadUrlForLayer&quot;,
                            + &quot;ecr:GetAuthorizationToken&quot;,
                            + &quot;ecr:BatchGetImage&quot;,
                            + &quot;ecr:BatchCheckLayerAvailability&quot;,
                          ]
                        + Effect    = &quot;Allow&quot;
                        + Principal = {
                            + AWS = &quot;arn:aws:iam::&lt;redacted&gt;:role/*&quot;
                          }
                        + Resource  = [
                            + &quot;arn:aws:ecr:us-east-1:&lt;redacted&gt;:repository/repo01&quot;,
                            + &quot;arn:aws:ecr:us-east-1:&lt;redacted&gt;:repository/repo02&quot;,
                          ]
                        + Sid       = &quot;AllowCrossAccountPull&quot;
                      },
                  ]
                + Version   = &quot;2012-10-17&quot;
              }
          )
        + registry_id = (known after apply)
      }
  
  Plan: 1 to add, 0 to change, 0 to destroy.
  </code></pre>
  <p>I'd appreciate any help because I lost track of how many changes I did to try to make this work.</p>