Read only ECR policy for organization

policy.js

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "ECR Read Only",
      "Effect": "Allow",
      "Principal": {
        "type": "*",
        "identifiers": ["*"]
      },
      "condition": {
        "test": "StringLike",
        "variable": "aws:PrincipalOrgID",
        // This is our organization-wide identifier which can be found after
        // log-in to AWS: <https://console.aws.amazon.com/organizations/home>
        "values": [
          "o-REDACTED"
        ]
      },
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetRepositoryPolicy",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecr:DescribeImages",
        "ecr:BatchGetImage",
        "ecr:DescribeImageScanFindings"
      ]
    }
  ]
}