- role_env: DBAAS_AWS_ROLE
  assignments:
    - repositorys:
        - type: query
          file: byoc-pull-images-aws-prod.yaml
          query: '(.kernelImages[]?, .dbaasImages[]?, .o11yImages[]?, .o11yCharts[]?) | select(.source | test("^380838443567[.]dkr[.]ecr[.]us-west-2[.]amazonaws[.]com/")) | .name'
      regions:
        - us-west-2
      accounts:
        - type: query
          file: byoc-pull-customers-aws-prod.yaml
          query: '.customers[].principals[]'
  policy:
    sid: "AllowBYOCCustomerPull"
    permissions:
      - "ecr:BatchCheckLayerAvailability"
      - "ecr:BatchGetImage"
      - "ecr:GetDownloadUrlForLayer"

- role_env: O11Y_AWS_ROLE
  assignments:
    - repositorys:
        - type: query
          file: byoc-pull-images-aws-prod.yaml
          query: '(.kernelImages[]?, .dbaasImages[]?, .o11yImages[]?, .o11yCharts[]?) | select(.source | test("^557537366020[.]dkr[.]ecr[.]us-west-2[.]amazonaws[.]com/")) | .name'
      regions:
        - us-west-2
      accounts:
        - type: query
          file: byoc-pull-customers-aws-prod.yaml
          query: '.customers[].principals[]'
  policy:
    sid: "AllowBYOCCustomerPull"
    permissions:
      - "ecr:BatchCheckLayerAvailability"
      - "ecr:BatchGetImage"
      - "ecr:GetDownloadUrlForLayer"