{"id":"ecr-repo-policy-or-iam-policy-either-grants","text":"For ECR repository access, a user only needs to be allowed by one policy type (repository policy OR IAM policy), not both — but an explicit deny in either takes precedence.","truth_value":"IN","source":"entries/2026/03/11/AmazonECR-latest-userguide-repository-policieshtml.md","source_url":"","source_hash":"51d7bfeeeaf47c26","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"ecr-repo-policy-or-iam-policy-either-grants","truth_value":"IN","reason":"premise"}]}}