Difference between revisions of "Terraform resource: aws ecr repository policy"

From wikieduonline
Jump to navigation Jump to search
 
Line 2: Line 2:
  
  
== Example ==
+
== Examples ==
 +
=== Official example ===
 +
<pre>
 +
resource "aws_ecr_repository" "foo" {
 +
  name = "bar"
 +
}
 +
 
 +
data "aws_iam_policy_document" "foopolicy" {
 +
  statement {
 +
    sid    = "new policy"
 +
    effect = "Allow"
 +
 
 +
    principals {
 +
      type        = "AWS"
 +
      identifiers = ["123456789012"]
 +
    }
 +
 
 +
    actions = [
 +
      "ecr:GetDownloadUrlForLayer",
 +
      "ecr:BatchGetImage",
 +
      "ecr:BatchCheckLayerAvailability",
 +
      "ecr:PutImage",
 +
      "ecr:InitiateLayerUpload",
 +
      "ecr:UploadLayerPart",
 +
      "ecr:CompleteLayerUpload",
 +
      "ecr:DescribeRepositories",
 +
      "ecr:GetRepositoryPolicy",
 +
      "ecr:ListImages",
 +
      "ecr:DeleteRepository",
 +
      "ecr:BatchDeleteImage",
 +
      "ecr:SetRepositoryPolicy",
 +
      "ecr:DeleteRepositoryPolicy",
 +
    ]
 +
  }
 +
}
 +
 
 +
resource "aws_ecr_repository_policy" "foopolicy" {
 +
  repository = aws_ecr_repository.foo.name
 +
  policy    = data.aws_iam_policy_document.foopolicy.json
 +
}
 +
</pre>
 +
 
 +
 
 +
 
 +
 
 +
=== Example ===
 
  resource "aws_ecr_repository_policy" "access_policy" {
 
  resource "aws_ecr_repository_policy" "access_policy" {
 
   for_each  = toset(var.your-org_ecr_repos)
 
   for_each  = toset(var.your-org_ecr_repos)

Latest revision as of 08:01, 17 May 2023

  • aws_ecr_repository_policy ref


Examples[edit]

Official example[edit]

resource "aws_ecr_repository" "foo" {
  name = "bar"
}

data "aws_iam_policy_document" "foopolicy" {
  statement {
    sid    = "new policy"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["123456789012"]
    }

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:PutImage",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload",
      "ecr:DescribeRepositories",
      "ecr:GetRepositoryPolicy",
      "ecr:ListImages",
      "ecr:DeleteRepository",
      "ecr:BatchDeleteImage",
      "ecr:SetRepositoryPolicy",
      "ecr:DeleteRepositoryPolicy",
    ]
  }
}

resource "aws_ecr_repository_policy" "foopolicy" {
  repository = aws_ecr_repository.foo.name
  policy     = data.aws_iam_policy_document.foopolicy.json
}



Example[edit]

resource "aws_ecr_repository_policy" "access_policy" {
 for_each   = toset(var.your-org_ecr_repos)
 repository = each.key

 policy = <<EOF
{
 "Version": "2008-10-17",
 "Statement": [
   {
     "Sid": "AllowPushPull",
     "Effect": "Allow",
     "Principal": {
       "AWS": [
         "arn:aws:iam::0123456789:root",
         "arn:aws:iam::9876543210:user/MyAdmin"
       ]
     },
     "Action": [
       "ecr:GetDownloadUrlForLayer",
       "ecr:BatchGetImage",
       "ecr:BatchCheckLayerAvailability",
       "ecr:PutImage",
       "ecr:InitiateLayerUpload",
       "ecr:UploadLayerPart",
       "ecr:CompleteLayerUpload"
     ]
   }
 ]
}
EOF

 depends_on = [aws_ecr_repository.your-org_repos]
}


Related[edit]

See also[edit]

Advertising: