title: Restrict access to namespace in ECR
body: <p>I want to restrict an EC2 instance to EC2 container registry (ECR) repositories with the same <a href="http://docs.aws.amazon.com/AmazonECR/latest/userguide/Repositories.html" rel="nofollow noreferrer">namespace</a>.</p>
  
  <p>The IAM instance role should <em>only</em> can pull all repositories under <code>AWS_ACCOUNT_ID.dkr.ecr.REGION.amazonaws.com/test-namespace/...</code>. Nothing else.</p>
  
  <p>I've tried the following IAM policy on an EC2 instance role:</p>
  
  <pre class="lang-js prettyprint-override"><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Stmt1490955256000",
              "Effect": "Allow",
              "Action": [
                  "ecr:GetAuthorizationToken",
                  "ecr:BatchCheckLayerAvailability",
                  "ecr:GetDownloadUrlForLayer",
                  "ecr:GetRepositoryPolicy",
                  "ecr:DescribeRepositories",
                  "ecr:ListImages",
                  "ecr:DescribeImages",
                  "ecr:BatchGetImage"
              ],
              "Resource": [
                  "arn:aws:ecr:REGION:AWS_ACCOUNT_ID:repository/test-namespace/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>But I was able to <code>docker pull</code> images from all repositories on that instance. E.g. <code>AWS_ACCOUNT_ID.dkr.ecr.REGION.amazonaws.com/test-repo:latest</code></p>
  
  <p>I don't see what I did wrong. It can't be the <a href="http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html" rel="nofollow noreferrer">resource-level permissions</a>. All of the above actions support them, except <code>ecr:GetAuthorizationToken</code>.</p>
  
  <p>As we have many repositories, I don't want to do set resource permissions on each repository.</p>