Status: IN
For ECR repository access, a user only needs to be allowed by one policy type (repository policy OR IAM policy), not both — but an explicit deny in either takes precedence.
Source: entries/2026/03/11/AmazonECR-latest-userguide-repository-policieshtml.md