Originally posted by @skorfmann in #5733 (comment)

I'm wondering what this means for IAM permissions. Here's an example which we're using at the moment:

    const taskDefinition = new ecs.FargateTaskDefinition(this, 'FooDefinition', {
      memoryLimitMiB: 2048,
      cpu: 1024    
    });

    const asset = new DockerImageAsset(this, 'FooEcrImage', {
      directory: path.join(__dirname, 'assets'),
    });
    
    asset.repository.grantPull(taskDefinition.taskRole)

(snippet from here https://gist.github.com/skorfmann/8da4eb64845e10f5937655520d53ac14#file-docker-image-asset-ts-L13-L22)

If I understand this change correctly, each principal which is granted access to the central ECR repository (aws-cdk/assets), will be able to pull all images. How's that aligned with the principle of minimal privilege?