(Without the need to make "dummy" Dockerfile which just inherits from public image and without pushing it to a private repository) . I have been trying to use public Docker image uri directly like this:

promtail_registry_image = docker.get_registry_image(
    name="public.ecr.aws/grafana/lambda-promtail:latest"
)
remote_image = docker.RemoteImage(
    "x-lambda-promtail-remote-image",
    name=promtail_registry_image.name,
    pull_triggers=[promtail_registry_image.sha256_digest],
)
promtail_lambda = aws.lambda_.Function(
    "x-lambda-promtail",
    timeout=30,
    memory_size=128,
    role=lambda_role.arn,
    image_uri=remote_image.id,
    package_type="Image",
    publish=True,
    opts=pulumi.ResourceOptions(depends_on=[lambda_role_policy]),
)

But it ends with an error message: 

error creating Lambda Function (1): InvalidParameterValueException: Source image sha256:fae905fb261fc02ffcd09052ae97c56c7ee18cf96d5dc2ddaf583ff2314284depublic.ecr.aws/grafana/lambda-promtail:latest is not valid. Provide a valid source image.

I also tried another property from remote_image output:

image_uri=remote_image.repo_digest

, with the same error ...

It really seems, that it is not possible to create Lambda function directly with the public ECR uri, at least for now.