This message was deleted.

hey! Just to make sure I'm understanding you have account A with an ECS cluster and task and then account B with an ECR repository where you want to pull images from right?

Hey Jim, looks like this question is more about AWS rather than Pulumi? I haven’t tried this solution but it might work: https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountPush",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account-id:root"
      },
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchCheckLayerAvailability",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ]
    }
  ]
}

thanks @fierce-ability-58936