Check provider logo

ECR repository is not publicly accessible

ecr_repositories_not_publicly_accessible

Severitycritical
Serviceecr
by Prowler
internet-exposedcontainer-security

Amazon ECR repositories are evaluated for public exposure via repository policies that allow anonymous principals (e.g., Principal: "*") to access the repo, including image listing, pulling, or modification.

Risk

Public access to ECR repositories weakens confidentiality and integrity.

Anyone can pull images, exposing proprietary code or embedded secrets; if pushes are allowed, attackers can poison images, enabling supply-chain compromise. Uncontrolled pulls can raise egress costs and leak repository metadata.

Run this check with Prowler CLI

prowler aws --checks ecr_repositories_not_publicly_accessible

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks ecr_repositories_not_publicly_accessible --fixer

Recommendation

Apply least privilege to repository policies:

  • Avoid Principal:"*" and block anonymous access
  • Grant minimal actions to specific accounts/roles
  • Require authenticated pulls/pushes via IAM
  • Use private connectivity (e.g., VPC endpoints)
  • Add defense in depth with image scanning and signing

Remediation

CLI

aws ecr delete-repository-policy --repository-name <example_resource_name>

Native IaC
Terraform
Other
  1. In the AWS Console, go to Amazon ECR > Repositories
  2. Select the repository
  3. Open the Permissions tab and click Edit
  4. Remove any statement with Principal set to "*", or replace it with specific AWS ARN(s) (e.g., arn:aws:iam::<example_resource_id>:root)
  5. Save changes

Source Code

Resource Type

AwsEcrRepository

References