Setting a repository policy statement - Amazon ECR Public

Setting a repository policy statement

You can add an access policy statement to a public repository in the AWS Management Console by following the steps below. You can add multiple policy statements per public repository. For example policies, see Public repository policy examples.


Amazon ECR requires that users have permission to make calls to the ecr-public:GetAuthorizationToken and sts:GetServiceBearerToken API through an IAM policy before they can authenticate to a registry and push any images to an Amazon ECR repository.

To set a repository policy statement

  1. Open the Amazon ECR console at

  2. From the navigation bar, choose the Region that contains the repository to set a policy statement on.

  3. In the navigation pane, choose Repositories.

  4. On the Repositories page, select the Public tab and then choose the repository to set a policy statement on.

  5. In the navigation pane, choose Permissions, Edit.

  6. On the Edit permissions page, choose Add statement.

  7. For Statement name, enter a name for the statement.

  8. For Effect, choose whether the policy statement will result in an allow or an explicit deny.

  9. For Principal, choose the scope to apply the policy statement to. For more information, see AWS JSON Policy Elements: Principal in the IAM User Guide.

    • You can apply the statement to all authenticated AWS users by selecting the Everyone (*) check box.

    • For Service principal, specify the service principal name (for example, to apply the statement to a specific service.

    • For AWS Account IDs, specify an AWS account number (for example, 111122223333) to apply the statement to all users under a specific AWS account. Multiple accounts can be specified by using a comma delimited list.

    • For IAM Entities, select the roles or users under your AWS account to apply the statement to.


      For more complicated repository policies that are not currently supported in the AWS Management Console, you can apply the policy with the set-repository-policy AWS CLI command.

  10. For Actions, choose the scope of the Amazon ECR API operations that the policy statement should apply to from the list of individual API operations.

  11. When you are finished, choose Save to set the policy.

  12. Repeat the previous step for each repository policy to add.