Ensure least-privilege access is enforced for Amazon ECR repositories used by EKS workloads

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review the IAM permissions and ECR repository policies that apply to repositories used by EKS workloads, and verify that access is limited to approved node roles, Fargate pod execution roles, CI/CD identities, and administrative roles. Confirm that pull access is limited to the minimum ECR actions required for image retrieval, that push or administrative access is scoped only to the repositories and actions required, and that no unnecessary wildcard or broad cross-account access is present.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Enforce least-privilege access for ECR repositories used by EKS workloads by separating image pull, image push, and repository administration into different IAM roles and policy scopes. Grant node roles and Fargate pod execution roles only the ECR permissions needed to authenticate and pull images, such as ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer. Scope CI/CD and administrator access to the specific repositories and actions they require, and review both IAM identity-based policies and ECR repository policies because ECR authorization can be affected by both. AWS also provides the AmazonEC2ContainerRegistryPullOnly managed policy for pull-only use cases. • Separate ECR access by role. Use different roles for node pulls, Fargate pulls, CI/CD pushes, and repository administration.