Cloudformation_ecr_role_working

gistfile1.txt

AWSTemplateFormatVersion: '2010-09-09'

Resources:
  Repository:
    Type: "AWS::ECR::Repository"
    Properties:
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          -
            Sid: AllowPushPull
            Effect: Allow
            Principal:
              AWS:
                - !GetAtt [ "PushRole", "Arn" ]
            Action:
              - "ecr:GetDownloadUrlForLayer"
              - "ecr:BatchGetImage"
              - "ecr:BatchCheckLayerAvailability"
              - "ecr:PutImage"
              - "ecr:InitiateLayerUpload"
              - "ecr:UploadLayerPart"
              - "ecr:CompleteLayerUpload"

  PushRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/application/"
      RoleName: "registry-push"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ec2.amazonaws.com"
            Action:
              - "sts:AssumeRole"

  PushPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "registry_push"
      Roles:
        - !Ref PushRole
      PolicyDocument:
          Version: "2012-10-17"
          Statement:
            -
              Resource: !Join [ "", [ "arn:aws:ecr:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId", ":repository/", !Ref Repository ] ]
              Effect: "Allow"
              Action:
                - "ecr:BatchDeleteImage"
                - "ecr:CompleteLayerUpload"
                - "ecr:InitiateLayerUpload"
                - "ecr:ListImages"
                - "ecr:PutImage"
                - "ecr:UploadLayerPart"