a pre-authenticated python-docker client instance.The configured credentials must have at least the following AWS IAM permissions associated with the ARNs of one or more ECR repositories that the connector will be allowed to access (e.g. arn:aws:ecr:{region}:{account}:repository/* represents all the ECR repositories available in the target AWS region).

ecr:DescribeRegistry

ecr:DescribeRepositories

ecr:ListRepositories

ecr:BatchGetImage

ecr:DescribeImages

ecr:BatchCheckLayerAvailability

ecr:GetDownloadUrlForLayer

ecr:InitiateLayerUpload

ecr:UploadLayerPart

ecr:CompleteLayerUpload

ecr:PutImage

ecr:GetAuthorizationToken

If you are using the AWS IAM role, Session Token, or Federation Token authentication methods, you don't have to worry too much about restricting the permissions of the AWS credentials that you use to access the AWS cloud resources. These authentication methods already support automatically generating temporary tokens with permissions down-scoped to the minimum required to access the target resource.

This resource type is not scoped to a single ECR repository. Instead, a connector configured with this resource type will grant access to all the ECR repositories that the credentials are allowed to access under the configured AWS region (i.e. all repositories under the Docker registry URL https://{account-id}.dkr.ecr.{region}.amazonaws.com).

The resource name associated with this resource type uniquely identifies an ECR registry using one of the following formats (the repository name is ignored, only the registry URL/ARN is used):

ECR repository URI (canonical resource name):

[https://]{account}.dkr.ecr.{region}.amazonaws.com[/{repository-name}]

ECR repository ARN :

arn:aws:ecr:{region}:{account-id}:repository[/{repository-name}]

ECR repository names are region scoped. The connector can only be used to access ECR repositories in the AWS region that it is configured to use.

Authentication Methods

Implicit authentication