RegistryPolicy

Source: src/AWS/ECR/RegistryPolicy.ts

The permissions policy for a private Amazon ECR registry — an account/region singleton used to grant other AWS accounts registry-level permissions (most commonly ecr:ReplicateImage when configuring cross-account replication).

Managing the Registry Policy

const policy = yield* RegistryPolicy("ReplicationPolicy", {
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Sid: "AllowReplication",
        Effect: "Allow",
        Principal: { AWS: `arn:aws:iam::${sourceAccountId}:root` },
        Action: ["ecr:ReplicateImage"],
        Resource: `arn:aws:ecr:us-east-1:${accountId}:repository/*`,
      },
    ],
  },
});