使用AWS CDK配置CodeBuild时调用ecr:GetAuthorizationToken操作被拒绝的问题求助

我在搭建基于AWS的Docker构建流水线时，每次执行这条ECR登录命令都会失败：

aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com

每次都会抛出这两个错误：

An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:sts::######:assumed-role/NetworkingStack-FargateBuildProjectRole/AWSCodeBuild is not authorized to perform: ecr:GetAuthorizationToken on resource: * because no identity-based policy allows the ecr:GetAuthorizationToken action
Error: Cannot perform an interactive login from a non TTY device

我是用AWS CDK来配置这条流水线的，下面是我为流水线创建的角色配置代码：

role: new Role(scope, `${name}PipelineRole`, {
  managedPolicies: [
    ManagedPolicy.fromAwsManagedPolicyName(
      "AmazonEC2ContainerRegistryFullAccess",
    ),
  ],
  assumedBy: new CompositePrincipal(
    new ServicePrincipal("codebuild.amazonaws.com"),
    new ServicePrincipal("codepipeline.amazonaws.com"),
  ),
  inlinePolicies: {
    EcrPushPolicy: new PolicyDocument({
      statements: [
        new PolicyStatement({
          actions: [
            "ecr:BatchCheckLayerAvailability",
            "ecr:BatchGetImage",
            "ecr:CompleteLayerUpload",
            "ecr:GetDownloadUrlForLayer",
            "ecr:InitiateLayerUpload",
            "ecr:PutImage",
            "ecr:UploadLayerPart",
          ],
          resources: [repository.repositoryArn],
        }),
        new PolicyStatement({
          actions: ["ecr:GetAuthorizationToken"],
          resources: ["*"],
        }),
      ],
    }),
  },
}),

我甚至特意加了重叠的权限（比如托管策略AmazonEC2ContainerRegistryFullAccess理论上已经包含相关权限了），但问题还是没解决，有没有大佬能帮我排查下问题出在哪？

内容来源于stack exchange