## The problem
Issue crossplane/crossplane#6137 (closed, 45 comments): A package OCI image built with xpkg and pushed to AWS ECR cannot be pulled by Crossplane, even though the Crossplane pod's service account has IRSA credentials. The reporter expected the pod's IAM role to be enough for ECR auth.
## What to do
Maintainer-confirmed setup: pulling ECR-hosted OCI packages works with IRSA and Pod Identity, but the IAM role attached to the Crossplane service account needs explicit ECR permissions. Attach a policy like: allow ecr:GetAuthorizationToken on all resources, plus ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage on the ECR repository. The pod having "all required auth via IRSA" is not enough on its own; without those ECR actions on the role, the pull fails. Add the policy to the role, restart or re-trigger the package fetch, and the ECR pull goes through.