1

我正在尝试按照使用亚马逊弹性容器注册表（ECR）的步骤，但我被困在第一步，即获取身份验证令牌。

命令：

aws ecr get-login

或者...

aws ecr get-login --region=us-west-2

错误：

An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::9#####4:user/### is not authorized to perform: ecr:GetAuthorizationToken on resource: *

区域 us-west-2 的用户 AWS 权限：

AmazonEC2FullAccess
AmazonEC2ContainerRegistryFullAccess
Billing
AdministratorAccess
AmazonECS_FullAccess

AWS CLI 版本：

aws help --version
aws-cli/1.14.40 Python/3.6.4 Darwin/18.2.0 botocore/1.8.44
4

1 回答 1

3

请注意，从某种意义上说，您不允许您的用户访问 ECR。尝试向用户添加以下策略：

{
"Version": "2012-10-17",
"Statement": [{
    "Effect": "Allow",
    "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetRepositoryPolicy",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecr:DescribeImages",
        "ecr:BatchGetImage"
    ],
    "Resource": "*"
}]
}

https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html#AmazonEC2ContainerRegistryReadOnly

于 2018-12-01T22:16:05.030 回答