You want to restrict access to an ECR repository so only a specific IAM role can pull images. Which approach is best?

hard📝 Application Q9 of 15

AWS - ECS and Fargate

AAttach a resource-based policy to the ECR repository allowing only that IAM role

BUse security groups to block all other users

CCreate a VPC endpoint and allow only that IAM role to use it

DTag the repository and rely on tags for access control

Step-by-Step Solution

Solution:

Step 1: Understand ECR access control methods
ECR supports resource-based policies to restrict access to specific IAM roles.
Step 2: Evaluate other options
Security groups control network traffic, not IAM permissions. VPC endpoints control network access but not IAM role permissions. Tags alone do not enforce access.
Final Answer:
Attach a resource-based policy to the ECR repository allowing only that IAM role -> Option A
Quick Check:
Use resource policies to restrict ECR access [OK]

Quick Trick: Use resource-based policies for fine-grained ECR access [OK]

Common Mistakes:

Master "ECS and Fargate" in AWS

9 interactive learning modes - each teaches the same concept differently

Want More Practice?

15+ quiz questions · All difficulty levels · Free

More AWS Quizzes