The Policy below prevents the account from self-managing container images. Users and Roles in the account cannot upload any container images unless the registry is owned by an approved ECR account ID.

ecr-registry-enforcement.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventSelfManagedImages",
      "Action": [
            "ecr:BatchDeleteImage",
            "ecr:CompleteLayerUpload",
            "ecr:Create*",
            "ecr:Delete*",
            "ecr:Initiate*",
            "ecr:Put*",
            "ecr:Set*",
            "ecr:Start*",
            "ecr:Upload*"
      ],
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalAccount": ["approved_ecr_account_id"]
        }
      }
    }
  ]
}