Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Elastic Container Registry Public

Amazon Elastic Container Registry Public (service prefix: ecr-public) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Elastic Container Registry Public
Actions defined by Amazon Elastic Container Registry Public
Resource types defined by Amazon Elastic Container Registry Public
Condition keys for Amazon Elastic Container Registry Public

API operations defined by Amazon Elastic Container Registry Public

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
BatchCheckLayerAvailability	ecr-public:BatchCheckLayerAvailability	Read
BatchDeleteImage	ecr-public:BatchDeleteImage	Write
CompleteLayerUpload	ecr-public:CompleteLayerUpload	Write
CreateRepository	ecr-public:CreateRepository	Write
CreateRepository	ecr-public:TagResource	Tagging, Write
DeleteRepository	ecr-public:DeleteRepository	Write
DeleteRepositoryPolicy	ecr-public:DeleteRepositoryPolicy	Write
DescribeImageTags	ecr-public:DescribeImageTags	List
DescribeImages	ecr-public:DescribeImages	Read
DescribeRegistries	ecr-public:DescribeRegistries	List
DescribeRepositories	ecr-public:DescribeRepositories	List
GetAuthorizationToken	ecr-public:GetAuthorizationToken	Read
GetAuthorizationToken	sts:GetServiceBearerToken	Read
GetRegistryCatalogData	ecr-public:GetRegistryCatalogData	Read
GetRepositoryCatalogData	ecr-public:GetRepositoryCatalogData	Read
GetRepositoryPolicy	ecr-public:GetRepositoryPolicy	Read
InitiateLayerUpload	ecr-public:InitiateLayerUpload	Write
ListTagsForResource	ecr-public:ListTagsForResource	Read
PutImage	ecr-public:PutImage	Write
PutRegistryCatalogData	ecr-public:PutRegistryCatalogData	Write
PutRepositoryCatalogData	ecr-public:PutRepositoryCatalogData	Write
SetRepositoryPolicy	ecr-public:SetRepositoryPolicy	Permissions management, Write
TagResource	ecr-public:TagResource	Tagging, Write
UntagResource	ecr-public:UntagResource	Tagging, Write
UploadLayerPart	ecr-public:UploadLayerPart	Write

Actions defined by Amazon Elastic Container Registry Public

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchCheckLayerAvailability	Grants permission to check the availability of multiple image layers in a specified registry and repository	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Read
BatchDeleteImage	Grants permission to delete a list of specified images within a specified repository	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Write
CompleteLayerUpload	Grants permission to inform Amazon ECR that the image layer upload for a specified registry, repository name, and upload ID, has completed	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Write
CreateRepository	Grants permission to create an image repository	repository*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecr-public:ResourceTag/${TagKey}	Write
DeleteRepository	Grants permission to delete an existing image repository	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Write
DeleteRepositoryPolicy	Grants permission to delete the repository policy from a specified repository	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Write
DescribeImageTags	Grants permission to describe all the image tags for a given repository	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	List
DescribeImages	Grants permission to get metadata about the images in a repository, including image size, image tags, and creation date	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Read
DescribeRegistries	Grants permission to retrieve the catalog data associated with a registry	registry*		List
DescribeRepositories	Grants permission to describe image repositories in a registry	repository	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	List
GetAuthorizationToken	Grants permission to retrieve a token that is valid for a specified registry for 12 hours			Read
GetRegistryCatalogData	Grants permission to retrieve the catalog data associated with a registry	registry*		Read
GetRepositoryCatalogData	Grants permission to retrieve the catalog data associated with a repository	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Read
GetRepositoryPolicy	Grants permission to retrieve the repository policy for a specified repository	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Read
InitiateLayerUpload	Grants permission to notify Amazon ECR that you intend to upload an image layer	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Write
ListTagsForResource	Grants permission to list the tags for an Amazon ECR resource	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Read
PutImage	Grants permission to create or update the image manifest associated with an image	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Write
PutRegistryCatalogData	Grants permission to create and update the catalog data associated with a registry	registry*		Write
PutRepositoryCatalogData	Grants permission to update the catalog data associated with a repository	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Write
SetRepositoryPolicy	Grants permission to apply a repository policy on a specified repository to control access permissions	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Permissions management, Write
TagResource	Grants permission to tag an Amazon ECR resource	repository*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecr-public:ResourceTag/${TagKey}	Tagging, Write
UntagResource	Grants permission to untag an Amazon ECR resource	repository*	aws:ResourceTag/${TagKey} aws:TagKeys ecr-public:ResourceTag/${TagKey}	Tagging, Write
UploadLayerPart	Grants permission to upload an image layer part to Amazon ECR Public	repository*	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Elastic Container Registry Public

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
registry	arn:${Partition}:ecr-public::${Account}:registry/${RegistryId}
repository	arn:${Partition}:ecr-public::${Account}:repository/${RepositoryName}	aws:ResourceTag/${TagKey} ecr-public:ResourceTag/${TagKey}

Resource types

ARN

Condition keys

registry

arn:${Partition}:ecr-public::${Account}:registry/${RegistryId}

repository

arn:${Partition}:ecr-public::${Account}:repository/${RepositoryName}

aws:ResourceTag/${TagKey}

ecr-public:ResourceTag/${TagKey}

Condition keys for Amazon Elastic Container Registry Public

Amazon Elastic Container Registry Public defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters create requests based on the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters actions based on tag-value associated with the resource	String
aws:TagKeys	Filters create requests based on the presence of mandatory tags in the request	ArrayOfString
ecr-public:ResourceTag/${TagKey}	Filters actions based on tag-value associated with the resource	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Elastic Container Registry (ecr)

Amazon Elastic Container Service (ecs)