Status: IN
Users must have `ecr:GetAuthorizationToken` permission via IAM identity-based policy before they can authenticate to an ECR registry or push/pull images — repository policies alone are insufficient.
Source: entries/2026/03/11/AmazonECR-latest-userguide-set-repository-policyhtml.md