SAM Doctor

ERROR REFERENCE

Lambda does not have permission to access the ECR image

The container-image function was created or updated, but the Lambda service itself could not pull the image from ECR. This is about the repository letting Lambda in — not about your deploy role's permissions, which is why widening your own policy does nothing.

WHAT IT MEANS

What this error means

Lambda pulls the image with its own service principal, authorized by the ECR repository policy. Same-account pulls are normally wired up automatically when the function is created through CloudFormation or SAM; the failure shows up with cross-account repositories, repositories whose policy was replaced, or an image tag/digest that no longer exists.

FIX

How to fix it

  1. Confirm the image reference still exists (read-only): 
    aws ecr describe-images --repository-name my-repo --image-ids imageTag=latest
    A retagged or lifecycle-expired image produces this error with a perfectly healthy policy.
  2. Read the repository policy: 
    aws ecr get-repository-policy --repository-name my-repo
    Lambda needs ecr:BatchGetImage and ecr:GetDownloadUrlForLayer granted to the lambda.amazonaws.com service principal — with source account/ARN conditions for cross-account setups.
  3. For cross-account images, the repository owner adds that policy; the function owner cannot grant it from their side.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes this service-side pull failure (high confidence) and keeps it distinct from the CI runner's own ECR login failures. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED