ECR Registry permissions - 'Invalid registry policy provided

Question

I am currently trying to setup replication between two accounts. On Account A I have a container image in ECR. On Account B I have two regions that need that image.

When I create the Registry Policy on eu-west-1, it works. When I try to create a similar policy on af-south-1 it fails. When I try to same policy on any other region, it works.

Not sure what I am doing wrong here. I am using the console. Generate statement> Cross account replication policy
Statement id: test
Accounts: {Working account ID}

Error:
Failed to create your statement
Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Invalid registry policy provided'

Edit:
Here is the statment that I am currently using, taken from the [documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry-permissions-examples.html?icmpid=docs_ecr_hp-registry-private)

```{
    "Version":"2012-10-17",
    "Statement":[
        {
            "Sid":"ReplicationAccessCrossAccount",
            "Effect":"Allow",
            "Principal":{
                "AWS":"arn:aws:iam::1111111111111:root"
            },
            "Action":[
                "ecr:CreateRepository",
                "ecr:ReplicateImage"
            ],
            "Resource": [
                "arn:aws:ecr:af-south-1:222222222222:repository/*"
            ]
        }
    ]
}
```

Accepted Answer

I was facing the same error.

In my case, my problem was that the af-south-1 region was not enabled in the aws account where my principal was configured.

in summary, if you have the principal:
```
            "Principal":{
                "AWS":"arn:aws:iam::1111111111111:root"
            }
```
then you must enable af-sout-1 region in the `1111111111111` account to be able to configure the policy.

Answer

Try this permission 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:GetRepositoryPolicy",
                "ecr:DescribeRepositories",
                "ecr:ListImages",
                "ecr:DescribeImages",
                "ecr:BatchGetImage",
                "ecr:GetLifecyclePolicy",
                "ecr:GetLifecyclePolicyPreview",
                "ecr:ListTagsForResource",
                "ecr:DescribeImageScanFindings"
            ],
            "Resource": "*"
        }
    ]
}

ECR Registry permissions - 'Invalid registry policy provided

Relevant content