ecr policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyPutImage",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "ecr:PutImage",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalArn": "arn:aws:iam::662322955137:role/service-role/pyei-challenge-codebuild-service-role"
        }
      }
    }
  ]
}

app config

rule prevent_inbound_Ipv4_access_to_any_ip when this.configuration.ipPermissions[*].ipv4Ranges !empty {
    this.configuration.ipPermissions[*].ipv4Ranges[*].cidrIp != "0.0.0.0/0" <<
    result: NON_COMPLIANT
    message: IPv4 Source address cannot be 0.0.0.0/0
    >>
}
rule prevent_inbound_Ipv6_access_to_any_ip when this.configuration.ipPermissions[*].ipv6Ranges !empty {
    this.configuration.ipPermissions[*].ipv6Ranges[*].cidrIpv6 != "::/0" <<
    result: NON_COMPLIANT
    message: IPv6 Source address cannot be ::/0
    >>
}