Question

有没有办法只授予用户推送/拉取他们在AWS ECS Repo中拥有的特定Docker镜像的权限？

Answer 1

您可以在帐户中配置IAM用户来推送和提取图片。

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowPushPull",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::aws_account_id:user/push-pull-user-1",
          "arn:aws:iam::aws_account_id:user/push-pull-user-2"
        ]
      },
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ]
    }
  ]
}

参考：documentation

Answer 2

这一次您可能有解决方案，但是在此处共享一些信息：

请考虑 2个具有以下权限的用户：

ecr-user，具有策略ARN ：arn:aws:iam::aws:policy/AdministratorAccess，具有对AWS中所有资源的管理员权限：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

vault-user，具有策略ARN ：arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy，具有受限权限：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "*"
        }
    ]
}

您可以从IAM->用户那里获取此信息，然后单击附加到该用户的Policy name 。

请考虑以下与用户相关联的两个存储库 ecr-user和vault-user

存储库ecr-permissions 已与 ecr-user链接，并具有以下权限：

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "denyAdmin",
      "Effect": "Deny",
      "Principal": {
        "AWS": "arn:aws:iam::****:user/ecr-user"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:DescribeImages",
        "ecr:ListImages",
        "ecr:PutImage",
        "ecr:PutLifecyclePolicy",
        "ecr:UploadLayerPart"
      ]
    }
  ]
}

因此，根据上述政策，您可以甚至限制管理员用户（ecr-user）推送到此存储库。

$ docker push ****.dkr.ecr.us-east-1.amazonaws.com/ecr-permissions:1.0
The push refers to repository [****.dkr.ecr.us-east-1.amazonaws.com/ecr-permissions]
fe6a7a3b3f27: Layer already exists 
d0673244f7d4: Layer already exists 
d8a33133e477: Layer already exists 
denied: User: arn:aws:iam::****:user/ecr-user is not authorized to perform: ecr:UploadLayerPart on resource: arn:aws:ecr:us-east-1:****:repository/ecr-permissions with an explicit deny

类似地，您可以允许非管理员/用户[在这种情况下为保险库用户] 对ECR存储库具有只读权限，可以通过调整ECR回购政策如下所示。

{ "Version": "2008-10-17", "Statement": [ { "Sid": "pushDocker", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::****:user/vault-user" }, "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:CompleteLayerUpload", "ecr:GetDownloadUrlForLayer", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart" ] } ] }

在添加上述政策之前：

$ docker push ****.dkr.ecr.us-east-1.amazonaws.com/rlokinen/first-ecr:0.3 The push refers to repository [****.dkr.ecr.us-east-1.amazonaws.com/rlokinen/first-ecr] fe6a7a3b3f27: Layer already exists d0673244f7d4: Layer already exists d8a33133e477: Layer already exists denied: User: arn:aws:iam::****:user/vault-user is not authorized to perform: ecr:InitiateLayerUpload on resource: arn:aws:ecr:us-east-1:****:repository/rlokinen/first-ecr

添加策略后：

$ docker push ****.dkr.ecr.us-east-1.amazonaws.com/rlokinen/first-ecr:0.3 The push refers to repository [****.dkr.ecr.us-east-1.amazonaws.com/rlokinen/first-ecr] fe6a7a3b3f27: Layer already exists d0673244f7d4: Layer already exists d8a33133e477: Layer already exists 0.3: digest: sha256:dc85890ba9763fe38b178b337d4ccc802874afe3c02e6c98c304f65b08af958f size: 948

这些策略是根据ECR中的REPO定义的。 ECR->Repositories-><REPO-NAME>permissions。

限制用户在AWS ECS Repo

2 个答案: