Add ecr:BatchGetImage permission to helm-publish workflow (#759)

Author: yerzhan7

.github/workflows/helm-publish.yaml

@@ -46,7 +46,6 @@ jobs:
         with:
           role-to-assume: ${{ vars.IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
-          # We only need valid credentials for authentication with ECR, so only ecr:GetAuthorizationToken.
           inline-session-policy: >-
             {
               "Version": "2012-10-17",
@@ -56,6 +55,12 @@ jobs:
                   "Effect":"Allow",
                   "Action":"ecr:GetAuthorizationToken",
                   "Resource":"*"
+                },
+                {
+                  "Sid":"AllowECRRead",
+                  "Effect": "Allow",
+                  "Action": "ecr:BatchGetImage",
+                  "Resource": "arn:aws:ecr:us-east-1:602401143452:repository/eks/*"
                 }
               ]
             }

scripts/verify-helm-images.sh

@@ -16,7 +16,7 @@ set -euo pipefail
 #   - yq: YAML processor (https://github.com/mikefarah/yq)
 #   - crane: Container registry tool (https://github.com/google/go-containerregistry/tree/main/cmd/crane)
 #
-# Note: AWS credentials are required with any ecr:GetAuthorizationToken permission to access EKS add-on repositories.
+# Note: AWS credentials are required with ecr:GetAuthorizationToken and ecr:BatchGetImage permissions to access EKS add-on repositories.
 
 CHART_DIR="charts/aws-mountpoint-s3-csi-driver"
 VALUES_FILE="${CHART_DIR}/values.yaml"