Home > Modules > Component: ecr

Component: ecr

No description available.

Component: ecr

This component is responsible for provisioning repositories, lifecycle rules, and permissions for streamlined ECR usage. This utlizes the roles-to-principals submodule to assign accounts to various roles.

Usage

Stack Level: Regional

Here’s an example snippet for how to use this component. This component should only be applied once as the resources it creates are global. This is typically done via the corp stack (e.g. uw2-corp.yaml).

components:
  terraform:
    ecr:
      vars:
        ecr_user_enabled: true
        max_image_count: 500
        scan_images_on_push: true
        cicd_accounts:
        - automation
        images:
          - infrastructure
          - microservice-a
          - microservice-b
          - microservice-c
        read_write_account_role_map:
          identity:
          - admin
          - ops
          - cicd
          automation:
          - admin
          - ops
        read_only_account_role_map:
          corp: ["*"]
          devdata: ["*"]
          devplatform: ["*"]
          proddata: ["*"]
          prodplatform: ["*"]
          stagedata: ["*"]
          stageplatform: ["*"]

Requirements

Name Version
terraform >= 0.12.0
aws >= 3.0
local >= 1.3
template >= 2.0

Providers

Name Version
terraform n/a

Inputs

Name Description Type Default Required
additional_tag_map Additional tags for appending to tags_as_list_of_maps. Not added to tags. map(string) {} no
attributes Additional attributes (e.g. 1) list(string) [] no
cicd_accounts List of accounts that have EKS service roles that can write to this ECR set(string) [] no
context Single object for setting entire context at once.See description of individual variables for details.Leave string and numeric variables as null to use default value.Individual variable settings (non-null) override settings in context object,except for attributes, tags, and additional_tag_map, which are merged. object({ enabled = bool namespace = string environment = string stage = string name = string delimiter = string attributes = list(string) tags = map(string) additional_tag_map = map(string) regex_replace_chars = string label_order = list(string) id_length_limit = number }) { “additional_tag_map”: {}, “attributes”: [], “delimiter”: null, “enabled”: true, “environment”: null, “id_length_limit”: null, “label_order”: [], “name”: null, “namespace”: null, “regex_replace_chars”: null, “stage”: null, “tags”: {}} no
delimiter Delimiter to be used between namespace, environment, stage, name and attributes.Defaults to - (hyphen). Set to "" to use no delimiter at all. string null no
enabled Set to false to prevent the module from creating any resources bool null no
environment Environment, e.g. ‘uw2’, ‘us-west-2’, OR ‘prod’, ‘staging’, ‘dev’, ‘UAT’ string null no
id_length_limit Limit id to this many characters.Set to 0 for unlimited length.Set to null for default, which is 0.Does not affect id_full. number null no
images List of image names (ECR repo names) to create repos for list(string) n/a yes
import_role_arn IAM Role ARN to use when importing a resource string null no
label_order The naming order of the id output and Name tag.Defaults to [“namespace”, “environment”, “stage”, “name”, “attributes”].You can omit any of the 5 elements, but at least one must be present. list(string) null no
max_image_count Max number of images to store. Old ones will be deleted to make room for new ones number 500 no
name Solution name, e.g. ‘app’ or ‘jenkins’ string null no
namespace Namespace, which could be your organization name or abbreviation, e.g. ‘eg’ or ‘cp’ string null no
read_only_account_role_map Map of account:[role, role…] for read-only access. Use * for role to grant access to entire account map(list(string)) {} no
read_write_account_role_map Map of account:[role, role…] for write access. Use * for role to grant access to entire account map(list(string)) n/a yes
regex_replace_chars Regex to replace chars with empty string in namespace, environment, stage and name.If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits. string null no
region AWS Region string n/a yes
stage Stage, e.g. ‘prod’, ‘staging’, ‘dev’, OR ‘source’, ‘build’, ‘test’, ‘deploy’, ‘release’ string null no
tags Additional tags (e.g. map('BusinessUnit','XYZ') map(string) {} no
tfstate_account_id The ID of the account where the Terraform remote state backend is provisioned string "" no
tfstate_assume_role Set to false to use the caller’s role to access the Terraform remote state bool true no
tfstate_bucket_environment_name The name of the environment for Terraform state bucket string "" no
tfstate_bucket_stage_name The name of the stage for Terraform state bucket string "root" no
tfstate_existing_role_arn The ARN of the existing IAM Role to access the Terraform remote state. If not provided and remote_state_assume_role is true, a role will be constructed from remote_state_role_arn_template string "" no
tfstate_role_arn_template IAM Role ARN template for accessing the Terraform remote state string "arn:aws:iam::%s:role/%s-%s-%s-%s" no
tfstate_role_environment_name The name of the environment for Terraform state IAM role string "gbl" no
tfstate_role_name IAM Role name for accessing the Terraform remote state string "terraform" no
tfstate_role_stage_name The name of the stage for Terraform state IAM role string "root" no

Outputs

Name Description
ecr_repo_arn_map Map of image names to ARNs
ecr_repo_url_map Map of image names to URLs

References