Allow ECR pull from controller IAM role

Goes some way to resolve coreos/coreos-kubernetes#620
cknowles · Nov 5, 2016 · 145aebb · 145aebb
1 parent 45452ba
commit 145aebb
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/config/templates/stack-template.json b/config/templates/stack-template.json
@@ -200,6 +200,19 @@
                   "Action" : "kms:Decrypt",
                   "Effect" : "Allow",
                   "Resource" : "{{.KMSKeyARN}}"
+                },
+                {
+                  "Action": [
+                    "ecr:GetAuthorizationToken",
+                    "ecr:BatchCheckLayerAvailability",
+                    "ecr:GetDownloadUrlForLayer",
+                    "ecr:GetRepositoryPolicy",
+                    "ecr:DescribeRepositories",
+                    "ecr:ListImages",
+                    "ecr:BatchGetImage"
+                  ],
+                  "Resource": "*",
+                  "Effect": "Allow"
                 }
               ],
               "Version": "2012-10-17"