how to allow a jenkins slave agent delete untagged ecr images - kubernetes

Question

Hi I am trying to write a simple pipeline to delete some ecr images that clutter the repo. I want Jenkins to do it. I get error:
An error occurred (AccessDeniedException) when calling the BatchDeleteImage operation: User: arn:aws:sts::~:assumed-role/~cluster-nodegr-NodeInstanceRole-~/i-~ is not authorized to perform: ecr:BatchDeleteImage on resource: arn:aws:ecr:~:~:repository/~ because no identity-based policy allows the ecr:BatchDeleteImage action
Jenkins is running on k8s. I used similar yaml in addition to other yamls to get up and running:
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: jenkins
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: jenkins
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
resources: ["pods/log"]
verbs: ["get","list","watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["watch"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: jenkins
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: jenkins
subjects:
- kind: ServiceAccount
name: jenkins
The pipeline looks like this:
pipeline {
agent {
kubernetes {
inheritFrom 'jenkins-slave'
}
}
stage('test') {
steps {
sh '''aws ecr batch-delete-image \
--repository-name <repo-name> \
--image-ids imageDigest=<img digest>
'''
}
}
}
I tried to add this:
- apiGroups: ["ecr"]
resources: ["*"]
verbs: ["batchDeleteImage"]
resourceNames:
- "*"
but didn't work.