World map

 

BM

World A2: Keys & Guards · Boss challenge

Just enough keys

You will learn: to let a CI role push one image to one repository, and nothing more.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Boss: Kedai Kancil’s workflow must push its image to the kedai shelf in ECR. Who should do the pushing?

Try it

Room 1: plan the build. Put the steps in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Add GitHub’s OIDC provider to IAM
  • Push the image, then check who you were
  • Make role ci-deployer, trusting only the shop repo
  • Give the workflow id-token: write
  • Attach a login policy and a push policy

Try it

Room 2: a teammate wrote this trust policy. Tap the line that lets strangers in.

Tap the risky line.

0 of 1 found

Try it

Room 3: the push policy works on every shelf. Fix the pink line so a push to kedai-admin gets Deny. Name only the kedai shelf.

Change the pink line so AWS says Deny.

The request

Who
ci-deployer (role session)arn:aws:sts::111122223333:assumed-role/ci-deployer/run-42
Wants to
ecr:PutImage
On
arn:aws:ecr:ap-southeast-5:111122223333:repository/kedai-admin
Identity policy (key ring) · ecr-push
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload",
"ecr:PutImage"
],
}
]
}

Predict

Room 4: before any push, the workflow must log in to ECR. That needs one more key. Which one?

Check

Room 5: the full set. The role pushes to the kedai shelf. Predict.

Read the request and its policies. Will AWS say Allow or Deny?

The request

Who
ci-deployer (role session)arn:aws:sts::111122223333:assumed-role/ci-deployer/run-42
Wants to
ecr:PutImage
On
arn:aws:ecr:ap-southeast-5:111122223333:repository/kedai
Identity policy (key ring) · ecr-login
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ecr:GetAuthorizationToken",
"Resource": "*"
}
]
}
Identity policy (key ring) · ecr-push
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload",
"ecr:PutImage"
],
"Resource": "arn:aws:ecr:ap-southeast-5:111122223333:repository/kedai"
}
]
}
Your guess:

Try it

Final room, for real (only with a budget alarm set). IAM is free; stored images cost a little. Clean-up list: the image, the repository, the role, the provider.

Real mission

0 of 7 steps done · Your ticks are saved.

You did it!

You can now give a CI role just enough keys: one shelf, push only.