2回答
- 新しい順
- 投票が多い順
- コメントが多い順
6
Yes but you need to watch out for:
- Repository policies must be explicit: You’ll need to enumerate account IDs in your ECR repository policy to grant access.
- Lambda service principal quirks: Lambda accesses ECR as a service principal, so aws:PrincipalOrgID conditions won’t work — you’ll need to use aws:sourceArn and service-specific conditions.
- GovCloud limitations: Public registries and pull-through cache rules are not supported in GovCloud.
1
- ECR repositories in GovCloud support resource-based policies, so you can share images across GovCloud accounts.
- However, Lambda in GovCloud does NOT support pulling images cross-account, even if ECR allows it.
- For cross-account usage, you’d either: replicate images to the other account’s ECR repo, or use ECS or other services that support pulling images cross-account (and have correct IAM permissions).
回答済み 4ヶ月前
