Grant cross-account access to ECS cluster EC2 instance role

[zackproser]

A customer asked:

I'm running a Nomad cluster in dev and want to pull some ECR images from shared-services which use a shared KMS key (container-images). I've set up the Nomad clients with the ecr-login docker config. How do I grant cross-account access to the assumed instance role for the client instances?

[zackproser]

So long as your ECR repo policy grants permission to the dev account, you can add the necessary ecr API permissions as a role policy on the nomad nodes. Here is how we do it for ECS.

[zackproser]

Credit for this solution goes to @bwhaley