ContainerRegistry

A repository resource policy grants ecr:PutImage to a principal in another AWS account, creating a cross-account supply-chain push trust.

An external principal granted ecr:PutImage via the repository's resource policy can push images (cross-account supply-chain attack).

A principal with ecr:DeleteRepositoryPolicy can delete the repository resource policy, removing all access controls and cross-account restrictions - policy-mutation escalation.

A principal with ecr:PutImageTagMutability can change an IMMUTABLE repository to MUTABLE, unblocking push overwrites on protected tags (prerequisite removal for CanModifyCode).

A public ECR repository is pull-accessible to any user on the internet without authentication, enabling supply-chain poisoning by external/anonymous attackers.

A principal with effective ecr:BatchGetImage + ecr:GetDownloadUrlForLayer can pull image layers, reading embedded secrets or proprietary code contained in the repository's images. For KMS-encrypted repositories, the principal must also hold kms:Decrypt on the repository's CMK.

An IAM principal with effective ecr:PutImage (+ layer-upload actions) on a repository can push/overwrite a mutable-tag image, injecting attacker code into every consumer that re-pulls that tag.

An image push to ECR emits EventBridge events (ecr:PutImage action emits ECR Image Action event) that can trigger downstream Compute workloads (Lambda, CodePipeline, deploy workers), enabling trigger-based code execution.

A registry-level replication policy allows an external account's repository to replicate images into the victim's registry, enabling cross-account supply-chain poisoning via the replication mechanism.

A principal with ecr:SetRepositoryPolicy can rewrite the repository resource policy to grant itself or any other principal push or pull access - policy-mutation escalation prerequisite.

Modify an Image Builder container recipe (or the pipeline referencing it) and trigger a build to push a poisoned container image to the target ECR repository, feeding the container-chains supply-chain fan-out to all downstream consumers.

anonymousPullEnabled == true on a registry makes image pull accessible to any unauthenticated client from the internet.

Full control of the registry (write + all sub-resource management).

importImage/action copies an external image into a registry tag - supply-chain write equivalent to AcrPush.

registries/listCredentials/action allows a principal to retrieve the admin account's long-lived passwords.

AcrPush (registries/push/write) over the registry - supply-chain primitive consumed by container-chains.

registries/write changes admin account state, trust policy, anonymous pull, network rules - alters the security posture of the entire registry.

scopeMaps/write allows a principal to modify repository-scoped token access policies, upgrading restricted tokens to include push/write capability.

registries/taskRuns/write queues a manual run of an existing ACR Task - triggers execution of whatever the current task definition specifies as the task's MI.

tasks/write over an ACR Task - modifies build steps (the BuildWorker's code) that run as the task's MI.

tokens/listPasswords/action returns long-lived passwords for a repository-scoped token - principal can retrieve static credential valid for the actions in the token's scope map.

Write access to a PaaS resource's privateEndpointConnections lets an attacker approve a PE connection from an attacker-controlled VNet, granting that VNet private network access to the resource - bypassing its public firewall.

An Artifact Registry repo IAM allow policy that grants roles/artifactregistry.writer (or uploadArtifacts) to a service account from a different GCP project establishes cross-project trust - that SA can push to this project's registry.

A principal that can set a repo's IAM policy can self-grant roles/artifactregistry.writer and then push, reaching CanModifyCode on the repo via policy manipulation.

Moving a tag to a different digest (artifactregistry.tags.update) is equivalent to a code push - mutable-tag consumers that re-pull will run the new image.

An Artifact Registry repo IAM binding for a Workload Identity Federation principalSet/principal with uploadArtifacts grants an external OIDC identity (e.g. GitHub Actions) direct push access - supply-chain from external CI into GCP workloads.

artifacts bucket ACL grants allUsers storage.objects.get - GCR registry is publicly pullable without authentication, exposing embedded secrets and proprietary code.

storage.objects.create on the GCR artifacts bucket = push/overwrite a container image - code control over the registry and supply-chain poisoning of every consumer that pulls a mutable tag.

GCR push event fires to the default gcr Pub/Sub topic, triggering any Cloud Build subscription - indirect trigger of build jobs running as the Cloud Build SA.

storage.objects.get on the GCR artifacts bucket = pull container image layers for inspection (embedded credential exfil / code recon) without push capability.

artifactregistry.repositories.uploadArtifacts on an Artifact Registry repository (or storage.objects.create on a legacy GCR bucket) lets an attacker push/overwrite an image tag that GKE workloads pull - registry-level CanModifyCode, propagated by container-chains to each consuming workload.

Pushing/overwriting an image in a registry poisons every workload that pulls it - code control propagates from the registry to each consuming Compute/KubernetesWorkload.