aws-eks-ecr-full-push-workflow
A principal holding the full ECR push permission set (BatchCheck + InitiateLayerUpload + UploadLayerPart + CompleteLayerUpload + PutImage) can push a complete new image.
match (effective permission)
{
"action": "ecr:InitiateLayerUpload",
"resource_type": "AWS::ECR::Repository"
}
where
?principal also has ecr:BatchCheckLayerAvailability, ecr:UploadLayerPart, ecr:CompleteLayerUpload, ecr:PutImage on ?repo
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <ECR repository (ContainerRegistry)> |
| permissions | ecr:BatchCheckLayerAvailability ecr:InitiateLayerUpload ecr:UploadLayerPart ecr:CompleteLayerUpload ecr:PutImage |
Narrative
{principal.name} holds the full ECR push permission set for {registry.name} (InitiateLayerUpload + UploadLayerPart + CompleteLayerUpload + PutImage), equivalent to CanModifyCode on the registry. Note: dedupes with aws-eks-ecr-put-image when PutImage is also present - emit once per (principal, repository).
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-ecr-full-push-workflow
emits: CanModifyCode
description: A principal holding the full ECR push permission set (BatchCheck + InitiateLayerUpload +
UploadLayerPart + CompleteLayerUpload + PutImage) can push a complete new image.
match_effective_permission:
action: ecr:InitiateLayerUpload
resource_type: AWS::ECR::Repository
where:
- ?principal also has ecr:BatchCheckLayerAvailability, ecr:UploadLayerPart, ecr:CompleteLayerUpload, ecr:PutImage
on ?repo
emit:
source_type: Identity
source: <principal>
target: <ECR repository (ContainerRegistry)>
permissions:
- ecr:BatchCheckLayerAvailability
- ecr:InitiateLayerUpload
- ecr:UploadLayerPart
- ecr:CompleteLayerUpload
- ecr:PutImage
api_source: iam:SimulatePrincipalPolicy | policy evaluation
narrative: "{principal.name} holds the full ECR push permission set for {registry.name} (InitiateLayerUpload\
\ + UploadLayerPart + CompleteLayerUpload + PutImage), equivalent to CanModifyCode on the registry.\
\ Note: dedupes with aws-eks-ecr-put-image when PutImage is also present \u2014 emit once per (principal,\
\ repository)."