How to Enable AWS Cross Account ECR Image Replication

Docker image hosted in ECR in  a AWS account can be replicated into another AWS account by enabling the cross account replication setup. For example, you host a docker image in AWS account A and you have a ECS cluster where you need to deploy the docker image.  

The steps require to enable cross account replication are:

1.Settings in the ECR host account:

• Enable cross account replication by specying the destination account name and region.

 

2.Settings in the replicaiton account

• Add a JSON permission policy with “CreateRepository” and “ReplicaiteImage” action. Also, specify the the ECR host repository ARN.

 

ECR host account settings

Click on the ECR registry

 

                             Select the private registry.

 

ECR replication account settings:

Go to the ECR registry and then select private and click on “Permissions”.

Next, add the below JSON policy. You need to replace the account ID in the Principal section by the account ID of your AWS ECR host account ID. In the “Resource” section of the policy you need to specify the account ID of the replicaiton account and replace repositoyr name “myrepo” by you reposityr name that is in the ECR host acount.

{
  "Sid": "replication-id",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::xxxxxxxxxxx1:root"
  },
  "Action": [
    "ecr:CreateRepository",
    "ecr:ReplicateImage"
  ],
  "Resource": "arn:aws:ecr:eu-west-1:xxxxxxxxxxx2:repository/myrepo"
}

Finally, push a docker image in the account A, and you will in the Account B a new ECR repository with the exact  same name of the account B.