data "aws_iam_policy_document" "this" {
  version = "2012-10-17"

  statement {
    sid    = "ReplicationAccessCrossAccount"
    effect = "Allow"
    actions = [
      "ecr:ReplicateImage"
    ]
    resources = [
      "arn:aws:ecr:${var.target_region_id}:${var.target_account_id}:repository/*"
    ]
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
    }
  }
}

resource "aws_ecr_registry_policy" "this" {
  policy = data.aws_iam_policy_document.this.json
}