Merge pull request #35 from c-knowles/allow-private-ecr-from-controller

Allow ECR pull from controller IAM role
kubernetes-retired · Nov 7, 2016 · 6255751 · 6255751
2 parents d07ba81 + 145aebb
commit 6255751
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/config/templates/stack-template.json b/config/templates/stack-template.json
@@ -200,6 +200,19 @@
                   "Action" : "kms:Decrypt",
                   "Effect" : "Allow",
                   "Resource" : "{{.KMSKeyARN}}"
+                },
+                {
+                  "Action": [
+                    "ecr:GetAuthorizationToken",
+                    "ecr:BatchCheckLayerAvailability",
+                    "ecr:GetDownloadUrlForLayer",
+                    "ecr:GetRepositoryPolicy",
+                    "ecr:DescribeRepositories",
+                    "ecr:ListImages",
+                    "ecr:BatchGetImage"
+                  ],
+                  "Resource": "*",
+                  "Effect": "Allow"
                 }
               ],
               "Version": "2012-10-17"