hub_ecr_repository_policy.tf

resource "aws_ecr_repository_policy" "hub_ecr_repository_policy" {
  repository = aws_ecr_repository.hub_ecr_repository.name
  policy = jsonencode(
    {
      "Version" : "2008-10-17",
      "Statement" : [
        {
          "Sid" : "AllowSpokeAccountsToPull",
          "Effect" : "Allow",
          "Principal" : {
            "AWS" : [
              "arn:aws:iam::1234567890:root"
            ]
          },
          "Action" : [
            "ecr:GetDownloadUrlForLayer",
            "ecr:BatchGetImage",
            "ecr:BatchCheckLayerAvailability"
          ]
        }
      ]
    }
  )
}