How do I build an AWS ECR repository policy with Pulumi?

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an ECR repository
const ecrRepository = new aws.ecr.Repository("my-repo");

// Define the policy for the ECR repository
const ecrPolicy = {
    Version: "2012-10-17",
    Statement: [
        {
            Effect: "Allow",
            Principal: "*",
            Action: [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ]
        },
        {
            Effect: "Allow",
            Principal: "*",
            Action: "ecr:PutImage",
            Condition: {
                StringEquals: {
                    "aws:PrincipalOrgID": "o-xxxxxxxxxx"
                }
            }
        }
    ]
};

// Attach the policy to the ECR repository
const repositoryPolicy = new aws.ecr.RepositoryPolicy("my-repo-policy", {
    repository: ecrRepository.name,
    policy: JSON.stringify(ecrPolicy),
});

// Export the repository URL
export const repositoryUrl = ecrRepository.repositoryUrl;