ECR: "Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Invalid registry policy provided.'"

Question

When using aws ecr put-registry-policy --policy-text file://ecr.json, I can only include **"ecr:CreateRepository"** and **"ecr:ReplicateImage"** When attempting to add other policies, an error occurs with the message "Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Invalid registry policy provided.'"

Here is the JSON policy file:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CrossAccountPull",
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::111111111111:root"]
      },
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ],
      "Resource": "arn:aws:ecr:ap-southeast-1:222222222222:repository/*"
    }
  ]
}
```

Accepted Answer

Not all ECR actions are allowed in registry policies. The allowed actions are listed here: 
https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry-permissions.html

Amazon ECR only enforces the following permissions at the private registry level. If any additional actions are added to the registry policy, an error will occur.

**ecr:ReplicateImage** – Grants permission to another account, referred to as the source registry, to replicate its images to your registry. This is only used for cross-account replication.

**ecr:BatchImportUpstreamImage** – Grants permission to retrieve the external image and import it to your private registry.

**ecr:CreateRepository** – Grants permission to create a repository in a private registry. This permission is required if the repository storing either the replicated or cached images doesn't already exist in the private registry.

**Note**
> While it is possible to add the ecr:* action to a private registry permissions policy, it is considered best practice to only add the specific actions required based on the feature you're using rather than use a wildcard.

I hope this helps

ECR: "Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Invalid registry policy provided.'"

Relevant content