iam_construction_iam_policy_ecr_repo_policy_document.tf

data "aws_iam_policy_document" "aws_ecr_repository_policy" {
  statement {
    sid = "KeyVaultPolicyForAccounts"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [for k in local.account_ids : "arn:aws:iam::${k}:root"]
    }
    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
    ]
  }
}