Merge pull request #16 from DNXLabs/feature/cross_account_policy

Adding AWS Lambda cross account deploy policy
DNXLabs · Apr 27, 2022 · 748efa8 · 748efa8
2 parents b3553ad + b8d4e6f
commit 748efa8
Showing 1 changed file with 20 additions and 0 deletions.
diff --git a/ecr-policies.tf b/ecr-policies.tf
@@ -37,6 +37,26 @@ resource "aws_ecr_repository_policy" "default" {
         "ecr:UploadLayerPart",
         "ecr:CompleteLayerUpload"
       ]
+    },
+    {
+      "Sid": "LambdaECRImageCrossAccountRetrievalPolicy",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "lambda.amazonaws.com"
+        ]
+      },
+      "Action": [
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage"
+      ],
+      "Condition": {
+        "StringLike": {
+          "aws:sourceArn": [
+            ${join(",", formatlist("\"arn:aws:lambda:%s:%s:function:*\"", data.aws_region.current.name, var.trust_accounts))}
+          ]
+        }
+      }
     }
   ]
 }