ecr:GetAuthorizationToken

     {
       Sid    = "AllowGetAuthorizationToken"
       Effect = "Allow"
       Action = [
         "ecr:GetAuthorizationToken"
       ]
       Resource = "*"
       Condition = {
         StringLike = {
           "token.actions.githubusercontent.com:sub" = "repo:your-repo-name/*"
         }
       }
     },

See also

• ecr:, ecr:GetAuthorizationToken, ecr:BatchGetImage, ecr:CompleteLayerUpload, ecr:ListImages, ecr:GetDownloadUrlForLayer, ecr:InitiateLayerUpload, managed policies for ECR