> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prepare an IAM-role-based ECR integration

> Generates a unique external ID and returns the trust + permission policies the customer attaches to a role in their own AWS account. Use the returned external ID and the created role ARN with the store credentials endpoint (credentialType=iam_role).



## OpenAPI

````yaml post /integrations/ecr/container-registry/organization/{organizationId}/credentials/prepare-iam-role
openapi: 3.0.0
info:
  title: Cybedefend API
  description: >-
    CybeDefend is an advanced API for application security analysis. Key
    features include OAuth 2.0 authentication, user/organization/project
    management, and REBAC-based permissions. It excels in static, dynamic, and
    IaC security analyses (SAST, DAST, IaC, etc.).
  version: '1.0'
  contact: {}
servers:
  - url: https://api-eu.cybedefend.com
    description: EU
  - url: https://api-us.cybedefend.com
    description: US
security: []
tags: []
paths:
  /integrations/ecr/container-registry/organization/{organizationId}/credentials/prepare-iam-role:
    post:
      tags:
        - ECR Container Registry
      summary: Prepare an IAM-role-based ECR integration
      description: >-
        Generates a unique external ID and returns the trust + permission
        policies the customer attaches to a role in their own AWS account. Use
        the returned external ID and the created role ARN with the store
        credentials endpoint (credentialType=iam_role).
      operationId: EcrContainerRegistryOrganizationController_prepareIamRole
      parameters:
        - name: organizationId
          required: true
          in: path
          description: CybeDefend organization ID
          schema:
            format: uuid
            example: 550e8400-e29b-41d4-a716-446655440000
            type: string
      requestBody:
        required: true
        description: Project + region the IAM-role integration targets
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EcrPrepareIamRoleDto'
      responses:
        '200':
          description: Setup instructions generated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EcrPrepareIamRoleResponseDto'
        '400':
          description: Invalid request body
          content:
            application/json:
              schema:
                example:
                  message: Bad Request
                  statusCode: 400
                  timestamp: '2025-02-18T12:31:18.491Z'
                  path: /example/path
        '401':
          description: Unauthorized - Invalid or missing authentication token
          content:
            application/json:
              schema:
                example:
                  message: Unauthorized
                  statusCode: 401
                  timestamp: '2025-02-18T12:31:18.491Z'
                  path: /example/path
        '403':
          description: Forbidden - Insufficient permissions to manage integrations
          content:
            application/json:
              schema:
                example:
                  message: Forbidden
                  statusCode: 403
                  timestamp: '2025-02-18T12:31:18.491Z'
                  path: /example/path
components:
  schemas:
    EcrPrepareIamRoleDto:
      type: object
      properties:
        projectId:
          type: string
          description: CybeDefend project ID this integration will belong to
          example: 097bbbf4-d1eb-4512-9950-684445279808
        awsRegion:
          type: string
          description: AWS Region of the target ECR registry
          example: us-east-1
      required:
        - awsRegion
    EcrPrepareIamRoleResponseDto:
      type: object
      properties:
        externalId:
          type: string
          description: Unique external ID to enforce in the role trust policy
        trustedPrincipalArn:
          type: string
          description: CybeDefend AWS principal the role must trust
        trustPolicyJson:
          type: string
          description: Ready-to-paste role trust policy (JSON)
        permissionPolicyJson:
          type: string
          description: Ready-to-paste ECR pull permission policy (JSON)
      required:
        - externalId
        - trustedPrincipalArn
        - trustPolicyJson
        - permissionPolicyJson

````