■ はじめに

Amazon Elastic Container Registry (ECR) を、Terraform で作る。

なお、ECRについては、以下の関連記事を参照のこと。

Amazon ECR ～入門編～
https://dk521123.hatenablog.com/entry/2020/05/22/165711
Amazon ECR ～基本編～
https://dk521123.hatenablog.com/entry/2020/05/26/142645

【１】公式ドキュメント
　１）Resource: aws_ecr_repository
　２）Resource: aws_ecr_lifecycle_policy
　３）Resource: aws_ecr_pull_through_cache_rule
　４）Resource: aws_ecr_repository_policy
　５）Resource: aws_ecr_registry_policy
【２】サンプル
　例１：Hello world
　例２：ECR repository policy
　例３：AWS ECR Public Gallery + pull through cache
【３】AWS ECR あれこれ
　１）コンテナイメージを push するには

【１】公式ドキュメント

１）Resource: aws_ecr_repository

* ECR リポジトリ作成

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository

２）Resource: aws_ecr_lifecycle_policy

* ECR リポジトリのライフサイクルポリシー

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_lifecycle_policy

３）Resource: aws_ecr_pull_through_cache_rule

* pull through cache rules の作成

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_pull_through_cache_rule

* pull through cache rules に関する詳細は、以下の関連記事を参照のこと

Amazon ECR ～ pull through cache rules ～
https://dk521123.hatenablog.com/entry/2024/04/09/141310

４）Resource: aws_ecr_repository_policy

* ECRリポジトリポリシーの作成

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_registry_policy

 => ECRリポジトリポリシーについては、以下の関連記事を参照のこと

Amazon ECR ～別アカウントのECRにPull/Push ～
https://dk521123.hatenablog.com/entry/2024/05/14/232934

５）Resource: aws_ecr_registry_policy

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_registry_policy

【２】サンプル

例１：Hello world

resource "aws_ecr_repository" "demo_ecr_repository" {
  name = "demo-ecr-repository"
  # The tag mutability setting for the repository. 
  # MUTABLE or IMMUTABLE
  image_tag_mutability = "MUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }
}

例２：ECR repository policy

# ECR Repository
resource "aws_ecr_repository" "demo_ecr_repository" {
  name = "demo-ecr-repository"
  image_tag_mutability = "MUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }
}

# For ECR repository policy
data "aws_iam_policy_document" "demo_ecr_iam_policy" {
  statement {
    sid    = "AllowPushPull"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::111111111111:role/your-iam-role"]
    }

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:PutImage",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload"
    ]
  }
}

resource "aws_ecr_repository_policy" "demo_ecr_repository_policy" {
  repository = aws_ecr_repository.demo_ecr_repository.name
  policy     = data.aws_iam_policy_document.demo_ecr_iam_policy.json
}

例３：AWS ECR Public Gallery + pull through cache

* 以下のサイトが参考になる

https://dev.classmethod.jp/articles/launch-ecs-task-from-public-image-through-vpce/
ecr.tf

# ECR Repository
resource "aws_ecr_repository" "demo_ecr_repository" {
  name = "demo-ecr-repository"
  image_tag_mutability = "MUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }
}

resource "aws_ecr_pull_through_cache_rule" "ecr_public" {
  ecr_repository_prefix = "ecr-public"
  upstream_registry_url = "public.ecr.aws"
}

iam.tf

resource "aws_iam_policy" "pull_through_cache" {
  name = "PullThroughCachePermission"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "ecr:BatchImportUpstreamImage",
          "ecr:CreateRepository",
        ]
        Resource = "*"
      }
    ]
  })
}

# 実行ロール(e.g. EC2 の role)にプルスルーキャッシュルールの使用に必要なポリシーを追加
resource "aws_iam_role_policy_attachment" "pull_through_cache" {
  role = "demo-ec2-role"
  policy_arn = aws_iam_policy.pull_through_cache.arn
}

【３】AWS ECR あれこれ

１）コンテナイメージを push するには

https://qiita.com/hayaosato/items/d6049cf68c84a26845d2

の null_resource が使えそう

null_resource
https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource

# パラメータ
locals {
  aws_region= "us-west-2"
  server_name = "xxx.xxx.us-west-2.amazonaws.com"
  image_name = "hello-world-ecr-repository"
  docker_dir = "."
}

# コンテナイメージを push する
resource "null_resource" "default" {

  # Step1: ECRにログインする
  # About "get-login-password", see https://awscli.amazonaws.com/v2/documentation/api/2.0.34/reference/ecr/get-login-password.html
  # About "aws ecr get-login", see https://docs.docker.jp/engine/reference/commandline/build.html
  provisioner "local-exec" {
    command = "$(aws ecr get-login --region ${local.aws_region} | docker login --username AWS --password-stdin  ${local.server_name})"
  }

  # Step2: 作成したDockerfileをビルドする
  # About "docker build", see https://docs.docker.jp/engine/reference/commandline/build.html
  provisioner "local-exec" {
    command = "docker build -t ${local.image_name} ${local.docker_dir}"
  }

  # Step3: タグづけする
  # About "docker tag", see https://docs.docker.jp/engine/reference/commandline/tag.html
  provisioner "local-exec" {
    command = "docker tag ${local.image_name}:latest ${aws_ecr_repository.demo_ecr_repository.repository_url}"
  }

  # Step4: ECRにプッシュする
  # About "docker push", see https://docs.docker.jp/engine/reference/commandline/push.html
  provisioner "local-exec" {
    command = "docker push ${aws_ecr_repository.demo_ecr_repository.repository_url}"
  }
}

参考文献

https://book.st-hakky.com/docs/infra-terraform-aws-ecr/

プログラムの超個人的なメモ

Memo for Programming.

【Terraform】Terraform ～ AWS ECR ～

■ はじめに

目次

【１】公式ドキュメント

１）Resource: aws_ecr_repository

２）Resource: aws_ecr_lifecycle_policy

３）Resource: aws_ecr_pull_through_cache_rule

４）Resource: aws_ecr_repository_policy

５）Resource: aws_ecr_registry_policy

【２】サンプル

例１：Hello world

例２：ECR repository policy

例３：AWS ECR Public Gallery + pull through cache

【３】AWS ECR あれこれ

１）コンテナイメージを push するには

参考文献

関連記事