enh: Teamcity IAM policy

[mglotov]

Prerequisites

Please answer the following questions for yourself before submitting an issue. YOU MAY DELETE THE PREREQUISITES SECTION.

• I am running the latest version
• I checked the documentation and found no answer
• I checked to make sure that this issue has not already been filed

Expected Behavior

Temcity can only pull and push images from/to ECR.

Current Behavior

Teamcity has full access to ECR (ecr:*)