Difference between revisions of "Terraform resource: aws ecr repository policy"

From wikieduonline
Jump to navigation Jump to search
 
(5 intermediate revisions by 2 users not shown)
Line 1: Line 1:
−
{{lc}}
+
* <code>aws_ecr_repository_policy</code> [https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy ref]
−
aws_ecr_repository_policy
 
−
* https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy
 
  
  
 +
== Examples ==
 +
=== Official example ===
 +
<pre>
 +
resource "aws_ecr_repository" "foo" {
 +
  name = "bar"
 +
}
  
 +
data "aws_iam_policy_document" "foopolicy" {
 +
  statement {
 +
    sid    = "new policy"
 +
    effect = "Allow"
 +
 +
    principals {
 +
      type        = "AWS"
 +
      identifiers = ["123456789012"]
 +
    }
 +
 +
    actions = [
 +
      "ecr:GetDownloadUrlForLayer",
 +
      "ecr:BatchGetImage",
 +
      "ecr:BatchCheckLayerAvailability",
 +
      "ecr:PutImage",
 +
      "ecr:InitiateLayerUpload",
 +
      "ecr:UploadLayerPart",
 +
      "ecr:CompleteLayerUpload",
 +
      "ecr:DescribeRepositories",
 +
      "ecr:GetRepositoryPolicy",
 +
      "ecr:ListImages",
 +
      "ecr:DeleteRepository",
 +
      "ecr:BatchDeleteImage",
 +
      "ecr:SetRepositoryPolicy",
 +
      "ecr:DeleteRepositoryPolicy",
 +
    ]
 +
  }
 +
}
 +
 +
resource "aws_ecr_repository_policy" "foopolicy" {
 +
  repository = aws_ecr_repository.foo.name
 +
  policy    = data.aws_iam_policy_document.foopolicy.json
 +
}
 +
</pre>
 +
 +
 +
 +
 +
=== Example ===
 
  resource "aws_ecr_repository_policy" "access_policy" {
 
  resource "aws_ecr_repository_policy" "access_policy" {
 
   for_each  = toset(var.your-org_ecr_repos)
 
   for_each  = toset(var.your-org_ecr_repos)
Line 23: Line 66:
 
       },
 
       },
 
       "Action": [
 
       "Action": [
−
         "ecr:GetDownloadUrlForLayer",
+
         "[[ecr:GetDownloadUrlForLayer]]",
−
         "ecr:BatchGetImage",
+
         "[[ecr:BatchGetImage]]",
−
         "ecr:BatchCheckLayerAvailability",
+
         "[[ecr:BatchCheckLayerAvailability]]",
−
         "ecr:PutImage",
+
         "[[ecr:PutImage]]",
−
         "ecr:InitiateLayerUpload",
+
         "[[ecr:InitiateLayerUpload]]",
−
         "ecr:UploadLayerPart",
+
         "[[ecr:UploadLayerPart]]",
−
         "ecr:CompleteLayerUpload"
+
         "[[ecr:CompleteLayerUpload]]"
 
       ]
 
       ]
 
     }
 
     }
Line 35: Line 78:
 
  }
 
  }
 
  EOF
 
  EOF
−
 
+
 
   depends_on = [aws_ecr_repository.your-org_repos]
 
   depends_on = [aws_ecr_repository.your-org_repos]
 
  }
 
  }

Latest revision as of 08:01, 17 May 2023

  • aws_ecr_repository_policy ref


Examples[edit]

Official example[edit]

resource "aws_ecr_repository" "foo" {
  name = "bar"
}

data "aws_iam_policy_document" "foopolicy" {
  statement {
    sid    = "new policy"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["123456789012"]
    }

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:PutImage",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:DescribeRepositories",
      "ecr:GetRepositoryPolicy",
      "ecr:ListImages",
      "ecr:DeleteRepository",
      "ecr:BatchDeleteImage",
      "ecr:SetRepositoryPolicy",
      "ecr:DeleteRepositoryPolicy",
    ]
  }
}

resource "aws_ecr_repository_policy" "foopolicy" {
  repository = aws_ecr_repository.foo.name
  policy     = data.aws_iam_policy_document.foopolicy.json
}



Example[edit]

resource "aws_ecr_repository_policy" "access_policy" {
 for_each   = toset(var.your-org_ecr_repos)
 repository = each.key

 policy = <<EOF
{
 "Version": "2008-10-17",
 "Statement": [
   {
     "Sid": "AllowPushPull",
     "Effect": "Allow",
     "Principal": {
       "AWS": [
         "arn:aws:iam::0123456789:root",
         "arn:aws:iam::9876543210:user/MyAdmin"
       ]
     },
     "Action": [
       "ecr:GetDownloadUrlForLayer",
       "ecr:BatchGetImage",
       "ecr:BatchCheckLayerAvailability",
       "ecr:PutImage",
       "ecr:InitiateLayerUpload",
       "ecr:UploadLayerPart",
       "ecr:CompleteLayerUpload"
     ]
   }
 ]
}
EOF

 depends_on = [aws_ecr_repository.your-org_repos]
}


Related[edit]

See also[edit]

Retrieved from "https://www.wikieduonline.com/index.php?title=Terraform_resource:_aws_ecr_repository_policy&oldid=249167"

Advertising: