A company uses AWS Organizations to manage a multi-account structure. The company has hundreds of AWS accounts and expects the number of accounts to…

This solution correctly addresses all requirements with the least operational overhead. Using a private Amazon ECR repository ensures the images are not publicly accessible. The repository permissions policy leverages the aws:PrincipalOrgID condition key, which is a scalable method to grant access to all current and future accounts within the AWS Organization without needing to manually update a list of account IDs. This minimizes management overhead. Furthermore, using a native ECR lifecycle policy is the most efficient, built-in mechanism to automatically clean up untagged images based on a count, avoiding the need to develop and maintain a custom solution like an AWS Lambda function.

B. Creating a public repository is insecure and violates the principle of least privilege, as the requirement is to restrict access only to accounts within the organization.

C. Manually listing all account IDs in a policy is not scalable and creates high operational overhead, especially as the number of accounts grows. Using a Lambda function for cleanup is also more overhead than a native ECR lifecycle policy.

D. A public repository is inappropriate for this use case. While a VPC endpoint policy can restrict access from within a VPC, it does not secure the repository from public access, and it adds unnecessary complexity.

---

References:

1. AWS ECR User Guide - Private repository policies: This document explains how to use resource-based permissions (repository policies) to control access. It provides examples of using the aws:PrincipalOrgID condition key to grant permissions to all accounts in an organization.

Source: AWS Documentation, Amazon ECR User Guide.

Reference: Section "Private repository policies", subsection "Using the aws:PrincipalOrgID condition key".

2. AWS IAM User Guide - AWS global condition context keys: This guide details the aws:PrincipalOrgID key, stating it can be used to "compare the ID of the organization in which the principal (user or role) making the request belongs to the organization ID specified in the policy." This confirms its suitability for scalable, organization-wide permissions.

Source: AWS Documentation, IAM User Guide.

Reference: Page "AWS global condition context keys", entry for aws:PrincipalOrgID.

3. AWS ECR User Guide - Lifecycle policies: This documentation describes how to set up automated rules to manage the lifecycle of images in a repository. It explicitly details rule parameters like tagStatus (tagged or untagged) and countType with imageCountMoreThan to retain a specific number of recent images.

Source: AWS Documentation, Amazon ECR User Guide.

Reference: Section "Lifecycle policies", subsection "Lifecycle policy examples".