AWS ECR Repository or Registry Policy Granted Public Access

This threat brief focuses on the misconfiguration of AWS Elastic Container Registry (ECR) policies, where repository or registry permissions are set to allow access to any principal. By modifying these policies via 'SetRepositoryPolicy' or 'PutRegistryPolicy' API calls to include an 'Allow' effect for a wildcard principal (Principal: "*"), an attacker or a misinformed administrator can expose private container images to the public internet. This exposure allows unauthorized, unauthenticated users to download proprietary images, potentially revealing sensitive source code, configuration secrets, or credentials baked into image layers. If the policy also grants write access, it facilitates supply-chain attacks, enabling malicious actors to inject compromised images into the environment, which downstream services like Amazon EKS, ECS, or Lambda may then execute. While intentional public image distribution is a valid use case for ECR, unauthorized changes often signal improper security management or malicious activity.

Impact

Successful exploitation of this misconfiguration results in the loss of intellectual property through unauthorized image pulling and exposes the organization to supply-chain compromise if push access is erroneously granted. Such vulnerabilities have direct consequences for data integrity and confidentiality in cloud-native environments.

Recommendation

Prioritize the identification of ECR repositories currently configured with wildcard access and evaluate their necessity.

• Implement detection for 'SetRepositoryPolicy' and 'PutRegistryPolicy' events within AWS CloudTrail to monitor for changes granting 'Allow' permissions to 'Principal: "*"'.
• Restrict IAM permissions for 'ecr:SetRepositoryPolicy' and 'ecr:PutRegistryPolicy' to a limited set of trusted administrators using least-privilege principles.
• Audit existing ECR policies to confirm that 'Principal: "*"' usage is intentional and restricted by 'Deny' statements or focused on read-only actions (pull-only).
• Use the provided investigation fields to identify the user identity, source IP, and user agent associated with any suspicious policy modifications.