AWS Elastic Beanstalk with Amazon ECR Docker image
per https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/iam-instanceprofile.html#iam-instanceprofile-addperms
open https://console.aws.amazon.com/iam/home#roles
Choose aws-elasticbeanstalk-ec2-role
On the Permissions tab, choose Attach policies.
select AmazonEC2ContainerRegistryReadOnly
Choose Attach policy
I'm not sure where it's written, but I needed to actually add the AmazonEC2ContainerRegistryReadOnly policy to aws-elasticbeanstalk-ec2-role. AmazonEC2ContainerRegistryReadOnly contains the GetAuthorizationToken action.