ECR repository is not publicly accessible

Check ID: ecr_repositories_not_publicly_accessible
Provider: AWS
Service: ecr
Severity: CRITICAL
Categories: internet-exposed, container-security
Resource type: AwsEcrRepository

What this check verifies

Amazon ECR repositories are evaluated for public exposure via repository policies that allow anonymous principals (e.g., Principal: "*") to access the repo, including image listing, pulling, or modification.

Risk

Public access to ECR repositories weakens confidentiality and integrity. Anyone can pull images, exposing proprietary code or embedded secrets; if pushes are allowed, attackers can poison images, enabling supply-chain compromise. Uncontrolled pulls can raise egress costs and leak repository metadata.

Recommendation

Apply least privilege to repository policies:

Avoid Principal:"*" and block anonymous access
Grant minimal actions to specific accounts/roles
Require authenticated pulls/pushes via IAM
Use private connectivity (e.g., VPC endpoints)
Add defense in depth with image scanning and signing

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecr delete-repository-policy —repository-name <example_resource_name>

resource "aws_ecr_repository_policy" "<example_resource_name>" {
  repository = "<example_resource_name>"
  policy     = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::<example_resource_id>:root" } # Critical: restricts access to a specific AWS principal; removes public (*) access
      Action    = "ecr:*"
    }]
  })
}

Resources:
  <example_resource_name>:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::<example_resource_id>:root"  # Critical: restricts access to a specific AWS account; removes public (*) access
            Action: "ecr:*"

References

https://docs.aws.amazon.com/AmazonECR/latest/public/security_iam_service-with-iam.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecr_repositories_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECR repository has a lifecycle policy configured [DEPRECATED] ECR repository scans images on push

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires