CodeBuild拉取合法ECR镜像失败：权限配置问题排查

尝试为CodeBuild配置最小权限服务角色，选择从ECR拉取自定义构建镜像而非预制镜像时，拉取失败，报错如下：

BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE: Unable to pull customer's container image. CannotPullContainerError: Error response from daemon: pull access denied for .dkr.ecr.us-east-1.amazonaws.com/my-ecr, repository does not exist or may require 'docker login': denied: User: CodeBuild

当前服务角色的内联策略如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ecr:DescribeImageScanFindings",
                "ecr:GetLifecyclePolicyPreview",
                "ecr:GetDownloadUrlForLayer",
                "ecr:DescribeImageReplicationStatus",
                "ecr:ListTagsForResource",
                "ecr:UploadLayerPart",
                "ecr:ListImages",
                "ecr:BatchGetRepositoryScanningConfiguration",
                "ecr:PutImage",
                "ecr:BatchGetImage",
                "ecr:CompleteLayerUpload",
                "ecr:DescribeImages",
                "ecr:DescribeRepositories",
                "ecr:InitiateLayerUpload",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetRepositoryPolicy",
                "ecr:GetLifecyclePolicy",
                "ecr:GetAuthorizationToken",
                "ecr:GetRegistryPolicy",
                "ecr:DescribeRegistry",
                "ecr:GetAuthorizationToken",
                "ecr:GetRegistryScanningConfiguration"
            ],
            "Resource": "arn:aws:ecr:us-east-1:<myacct>:repository/my-ecr"
        }
    ]
}

1. ecr:GetAuthorizationToken 资源范围不匹配
   这个操作属于ECR注册表级权限，不能绑定到单个仓库ARN。你的策略里把它和仓库级操作放在同一规则中，资源限定为单个仓库，导致CodeBuild无法获取登录ECR的授权令牌，完成不了镜像拉取的前置登录步骤。

2. 冗余权限配置（非直接原因，但不符合最小权限原则）
   策略里包含了大量上传镜像相关的操作（如ecr:UploadLayerPart、ecr:PutImage等），拉取镜像根本不需要这些权限，属于多余配置，后续可以清理。

拆分注册表级和仓库级权限，仅保留拉取镜像必需的操作：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ECRRegistryAuth",
            "Effect": "Allow",
            "Action": "ecr:GetAuthorizationToken",
            "Resource": "*"
        },
        {
            "Sid": "ECRPullImagePermissions",
            "Effect": "Allow",
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
                "ecr:DescribeRepositories"
            ],
            "Resource": "arn:aws:ecr:us-east-1:<myacct>:repository/my-ecr"
        }
    ]
}

内容的提问来源于stack exchange，提问作者Woodsman