-
Interface Summary Interface Description CfnPublicRepositoryProps Properties for defining a `AWS::ECR::PublicRepository`.CfnRegistryPolicyProps Properties for defining a `AWS::ECR::RegistryPolicy`.CfnReplicationConfiguration.ReplicationConfigurationProperty CfnReplicationConfiguration.ReplicationDestinationProperty CfnReplicationConfiguration.ReplicationRuleProperty CfnReplicationConfigurationProps Properties for defining a `AWS::ECR::ReplicationConfiguration`.CfnRepository.LifecyclePolicyProperty CfnRepositoryProps Properties for defining a `AWS::ECR::Repository`.IRepository Represents an ECR repository.IRepository.Jsii$Default Internal default implementation forIRepository.LifecycleRule An ECR life cycle rule.OnCloudTrailImagePushedOptions Options for the onCloudTrailImagePushed method.OnImageScanCompletedOptions Options for the OnImageScanCompleted method.RepositoryAttributes RepositoryProps -
Enum Summary Enum Description TagMutability The tag mutability setting for your repository.TagStatus Select images based on tags.
Package software.amazon.awscdk.services.ecr Description
Amazon ECR Construct Library
---
This package contains constructs for working with Amazon Elastic Container Registry.
Repositories
Define a repository by creating a new instance of Repository. A repository
holds multiple verions of a single container image.
// Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826 Object repository = new Repository(this, "Repository");
Image scanning
Amazon ECR image scanning helps in identifying software vulnerabilities in your container images. You can manually scan container images stored in Amazon ECR, or you can configure your repositories to scan images when you push them to a repository. To create a new repository to scan on push, simply enable imageScanOnPush in the properties
// Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
Object repository = Repository.Builder.create(stack, "Repo")
.imageScanOnPush(true)
.build();
To create an onImageScanCompleted event rule and trigger the event target
// Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
repository.onImageScanCompleted('ImageScanComplete').addTarget(...);
Authorization Token
Besides the Amazon ECR APIs, ECR also allows the Docker CLI or a language-specific Docker library to push and pull images from an ECR repository. However, the Docker CLI does not support native IAM authentication methods and additional steps must be taken so that Amazon ECR can authenticate and authorize Docker push and pull requests. More information can be found at at Registry Authentication.
A Docker authorization token can be obtained using the GetAuthorizationToken ECR API. The following code snippets
grants an IAM user access to call this API.
// Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826 import software.amazon.awscdk.services.iam.*; import software.amazon.awscdk.services.ecr.*; User user = new User(this, "User", new UserProps()...); ecr.AuthorizationToken.grantRead(user);
If you access images in the Public ECR Gallery as well, it is recommended you authenticate to the registry to benefit from higher rate and bandwidth limits.
See
Pricingin https://aws.amazon.com/blogs/aws/amazon-ecr-public-a-new-public-container-registry/ and Service quotas.
The following code snippet grants an IAM user access to retrieve an authorization token for the public gallery.
// Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826 import software.amazon.awscdk.services.iam.*; import software.amazon.awscdk.services.ecr.*; User user = new User(this, "User", new UserProps()...); ecr.PublicGalleryAuthorizationToken.grantRead(user);
This user can then proceed to login to the registry using one of the authentication methods.
Image tag immutability
You can set tag immutability on images in our repository using the imageTagMutability construct prop.
// Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826 Repository.Builder.create(stack, "Repo").imageTagMutability(ecr.TagMutability.getIMMUTABLE()).build();
Automatically clean up repositories
You can set life cycle rules to automatically clean up old images from your repository. The first life cycle rule that matches an image will be applied against that image. For example, the following deletes images older than 30 days, while keeping all images tagged with prod (note that the order is important here):
// Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
repository.addLifecycleRule(Map.of("tagPrefixList", asList("prod"), "maxImageCount", 9999));
repository.addLifecycleRule(Map.of("maxImageAge", cdk.Duration.days(30)));