AWS CodeBuild Unable to pull image due to permission issue

The message on AWS Code Build is:
Unable to pull customer's container image. CannotPullContainerError: Error response from daemon: pull access denied for <myacct>.dkr.ecr.us-east-1.amazonaws.com/my-ecr, repository does not exist or may require 'docker login': denied: User: CodeBuild

I'm trying use a docker image to build and deploy some AWS lambdas. The code would work and has worked when IAM cooperates. I don't understand the message as I have no user "CodeBuild". I would have thought it would assume the service role I specified "arn:aws:iam::<myacct>:role/service-role/codebuild-service-role".

My ECR is a private registry and I'm able to pull, build and deploy from it using the CLI under my users access key and after I do the docker login command given from AWS. The ECR registry <myacct>.dkr.ecr.us-east-1.amazonaws.com/my-ecr does exist.

When I gave everyone full access to my ECR using this policy:

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowAllAccess",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "*"
    }
  ]
}

the build worked perfectly.

However, when I try to restrict it as :

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCompleteReadAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<myacct>:role/service-role/codebuild-service-role"
      },
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:BatchGetRepositoryScanningConfiguration",
        "ecr:DescribeImageReplicationStatus",
        "ecr:DescribeImageScanFindings",
        "ecr:DescribeImages",
        "ecr:DescribePullThroughCacheRules",
        "ecr:DescribeRepositories",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetLifecyclePolicy",
        "ecr:GetLifecyclePolicyPreview",
        "ecr:GetRegistryPolicy",
        "ecr:GetRegistryScanningConfiguration",
        "ecr:GetRepositoryPolicy",
        "ecr:ListImages"
      ]
    }
  ]
}

it no longer works.

I'm still learning IAM. Grammatically, I thought the principal was the entity or thing being granted the access. However, it sometimes seems to refer to the thing that access will be granted. Think of this like nouns in a sentence. Bob gives Dave the ball. The principal could be Bob or it could be Dave. It's not clear which in these cases.

I believe I can confidently say, both my ECR and my AWS CodeBuild project need permissions set. I cannot just give the CodeBuild project solely by changing the permission there. I need to also set it in the ECR.

What I do not know is how to refer to the CodeBuild project in the ECR policy statement, especially since it's using some undefined user CodeBuild that may or may not be assuming a role, but it doesn't say which one.

Try setting this as your principal:

 "Principal":{
   "Service":"codebuild.amazonaws.com"
 },

Source