confirm ecr permissions, leave upstream permissions as-is

platform9 · Sep 5, 2024 · e3ba0f1 · e3ba0f1
1 parent e01fcaf
commit e3ba0f1
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/emp/emp_role_cftemplate.yaml b/emp/emp_role_cftemplate.yaml
@@ -21,7 +21,8 @@ Resources:
               - ec2:DescribeTags
               - ec2:DescribeNetworkInterfaces
 #              - ec2:DescribeInstanceTypes commenting, not deleting capa actions. This is accounted for below
-              # check with team if ecr:<action is needed>
+              # needed to pull an image from ecr. EKS bootstrap script adds an entry for the sandbox image
+              # with an ecr URL in containerd config, so these are needed
               - ecr:GetAuthorizationToken
               - ecr:BatchCheckLayerAvailability
               - ecr:GetDownloadUrlForLayer