Update CHANGELOG

Author: ingalls

CHANGELOG.md

@@ -12,6 +12,10 @@
 
 ### Pending Release
 
+### v2.10.0
+
+- :bug: Update Lambda Access to ECR Policy
+
 ### v2.9.0
 
 - :rocket: Include Root in ACM

cloudformation/lib/ecr.js

@@ -55,6 +55,20 @@ export default {
                             'ecr:BatchGetImage',
                             'ecr:GetDownloadUrlForLayer'
                         ]
+                    },{
+                        Effect: 'Allow',
+                        Principal: {
+                            Service: 'lambda.amazonaws.com'
+                        },
+                        Action: [
+                            'ecr:BatchGetImage',
+                            'ecr:GetDownloadUrlForLayer'
+                        ],
+                        Condition: {
+                            StringLike: {
+                                'aws:sourceArn': cf.join(['arn:', cf.partition, ':lambda:', cf.region, ':', cf.accountId, ':function:*'])
+                            }
+                        }
                     }]
                 }
             }