GitLab and GitLab runners are running on the same host (I know how bad it is). There is an IAM Role attached to the EC2 on which GitLab is running.
This IAM Role gives the permission to perform some actions on multi-account ECR's.
Runners use docker as executor and assume role perfectly to push,pull images. But, if images need to be pulled/pushed to the account on which GitLab is running, it doesn't work. I first need to pull images on the GitLab host so they are accessible within the runners.
I did a small test: I manually started a container directly on the GitLab host and ran
aws ecr get-login... and I was able to login on the account.
I've installed amazon-ecr-credential-helper and configured like stated in the doc.
I don't understand why runners cannot pull images from the account...