Function parse_ecr_image_repository 

pub fn parse_ecr_image_repository(
    image: &str,
) -> Result<EcrImageRepository<'_>, String>

Reads privateBaseImage as the one repository a build role may pull from.

The name is interpolated into an IAM ARN, so it is held to ECR’s own repository grammar: that refuses * and ?, which would widen the grant, and $ and braces, which a CloudFormation Sub or a Terraform template would read as an expression.