ECR cross-account pull permissions

Solution 1:

You also need to configure permissions in the ECR for cross account access. To give pull access to the ECR of Account A to Account B, put the following JSON policy in the ECR Permissions tab.

{
    "Version": "2008-10-17",
    "Statement": [
      {
        "Sid": "AllowCrossAccountPull",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::aws_account_b_number:root"
        },
        "Action": [
          "ecr:GetDownloadUrlForLayer",
          "ecr:BatchCheckLayerAvailability",
          "ecr:BatchGetImage"
        ]
      }
    ]
  }

Solution 2:

You need to setup a cross account role for Account b to assume.

Create the cross account role in the account that has the Registry, A, give access to the registry in the role. And give the Account B the permissions to assume that role.

http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html