Skip to content

Commit 553bbde

Browse files
LeoDiazLLeoDiazL
committed
add-ecr-registry-external-account-read-write
1 parent 206854d commit 553bbde

File tree

6 files changed

+111
-0
lines changed

6 files changed

+111
-0
lines changed

‎action.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -987,6 +987,12 @@ inputs:
987987
aws_ecr_repo_write_arn:
988988
description: 'The ARNs of the IAM users/roles that have read/write access to the repository. (Comma separated list)'
989989
required: false
990+
aws_ecr_repo_read_external_aws_account:
991+
description: 'The ARNs of the external AWS accounts that have read access to the repository'
992+
required: false
993+
aws_ecr_repo_write_external_aws_account:
994+
description: 'The ARNs of the external AWS accounts that have write access to the repository'
995+
required: false
990996
aws_ecr_repo_read_arn_lambda:
991997
description: 'The ARNs of the Lambda service roles that have read access to the repository. (Comma separated list)'
992998
required: false
@@ -1547,6 +1553,8 @@ runs:
15471553
AWS_ECR_REPO_POLICY_INPUT: ${{ inputs.aws_ecr_repo_policy_input }}
15481554
AWS_ECR_REPO_READ_ARN: ${{ inputs.aws_ecr_repo_read_arn }}
15491555
AWS_ECR_REPO_WRITE_ARN: ${{ inputs.aws_ecr_repo_write_arn }}
1556+
AWS_ECR_REPO_READ_EXTERNAL_AWS_ACCOUNT: ${{ inputs.aws_ecr_repo_read_external_aws_account }}
1557+
AWS_ECR_REPO_WRITE_EXTERNAL_AWS_ACCOUNT: ${{ inputs.aws_ecr_repo_write_external_aws_account }}
15501558
AWS_ECR_REPO_READ_ARN_LAMBDA: ${{ inputs.aws_ecr_repo_read_arn_lambda }}
15511559
AWS_ECR_LIFECYCLE_POLICY_INPUT: ${{ inputs.aws_ecr_lifecycle_policy_input }}
15521560
AWS_ECR_PUBLIC_REPO_CATALOG: ${{ inputs.aws_ecr_public_repo_catalog }}

‎operations/_scripts/generate/generate_vars_terraform.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -381,6 +381,8 @@ if [[ $(alpha_only "$AWS_ECR_REPO_CREATE") == true ]]; then
381381
aws_ecr_repo_policy_input=$(generate_var aws_ecr_repo_policy_input $AWS_ECR_REPO_POLICY_INPUT)
382382
aws_ecr_repo_read_arn=$(generate_var aws_ecr_repo_read_arn $AWS_ECR_REPO_READ_ARN)
383383
aws_ecr_repo_write_arn=$(generate_var aws_ecr_repo_write_arn $AWS_ECR_REPO_WRITE_ARN)
384+
aws_ecr_repo_read_external_aws_account=$(generate_var aws_ecr_repo_read_external_aws_account $AWS_ECR_REPO_READ_EXTERNAL_AWS_ACCOUNT)
385+
aws_ecr_repo_write_external_aws_account=$(generate_var aws_ecr_repo_write_external_aws_account $AWS_ECR_REPO_WRITE_EXTERNAL_AWS_ACCOUNT)
384386
aws_ecr_repo_read_arn_lambda=$(generate_var aws_ecr_repo_read_arn_lambda $AWS_ECR_REPO_READ_ARN_LAMBDA)
385387
aws_ecr_lifecycle_policy_input=$(generate_var aws_ecr_lifecycle_policy_input $AWS_ECR_LIFECYCLE_POLICY_INPUT)
386388
aws_ecr_public_repo_catalog=$(generate_var aws_ecr_public_repo_catalog $AWS_ECR_PUBLIC_REPO_CATALOG)
@@ -743,6 +745,8 @@ $aws_ecr_repo_policy_create
743745
$aws_ecr_repo_policy_input
744746
$aws_ecr_repo_read_arn
745747
$aws_ecr_repo_write_arn
748+
$aws_ecr_repo_read_external_aws_account
749+
$aws_ecr_repo_write_external_aws_account
746750
$aws_ecr_repo_read_arn_lambda
747751
$aws_ecr_lifecycle_policy_input
748752
$aws_ecr_public_repo_catalog

‎operations/deployment/terraform/aws/aws_variables.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1718,6 +1718,18 @@ variable "aws_ecr_lifecycle_policy_input" {
17181718
default = ""
17191719
}
17201720

1721+
variable "aws_ecr_repo_read_external_aws_account" {
1722+
description = "The ARNs of the external AWS accounts that have read access to the repository"
1723+
type = string
1724+
default = ""
1725+
}
1726+
1727+
variable "aws_ecr_repo_write_external_aws_account" {
1728+
description = "The ARNs of the external AWS accounts that have write access to the repository"
1729+
type = string
1730+
default = ""
1731+
}
1732+
17211733
variable "aws_ecr_public_repo_catalog" {
17221734
description = "Catalog data configuration for the repository"
17231735
type = any

‎operations/deployment/terraform/aws/bitovi_main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -600,6 +600,8 @@ module "aws_ecr" {
600600
aws_ecr_repo_policy_input = var.aws_ecr_repo_policy_input
601601
aws_ecr_repo_read_arn = var.aws_ecr_repo_read_arn
602602
aws_ecr_repo_write_arn = var.aws_ecr_repo_write_arn
603+
aws_ecr_repo_read_external_aws_account = var.aws_ecr_repo_read_external_aws_account
604+
aws_ecr_repo_write_external_aws_account = var.aws_ecr_repo_write_external_aws_account
603605
aws_ecr_repo_read_arn_lambda = var.aws_ecr_repo_read_arn_lambda
604606
aws_ecr_lifecycle_policy_input = var.aws_ecr_lifecycle_policy_input
605607
aws_ecr_public_repo_catalog = var.aws_ecr_public_repo_catalog

‎operations/deployment/terraform/modules/aws/ecr/aws_ecr_policies.tf‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ locals {
55
aws_ecr_repo_read_arn = var.aws_ecr_repo_read_arn != "" ? [for n in split(",", var.aws_ecr_repo_read_arn) : (n)] : []
66
aws_ecr_repo_write_arn = var.aws_ecr_repo_write_arn != "" ? [for n in split(",", var.aws_ecr_repo_write_arn) : (n)] : []
77
aws_ecr_repo_read_arn_lambda = var.aws_ecr_repo_read_arn_lambda != "" ? [for n in split(",", var.aws_ecr_repo_read_arn_lambda) : (n)] : []
8+
aws_ecr_repo_read_external_aws_account = var.aws_ecr_repo_read_external_aws_account != "" ? [for n in split(",", var.aws_ecr_repo_read_external_aws_account) : "arn:${data.aws_partition.current.partition}:iam::${n}:root"] : []
9+
aws_ecr_repo_write_external_aws_account = var.aws_ecr_repo_write_external_aws_account != "" ? [for n in split(",", var.aws_ecr_repo_write_external_aws_account) : "arn:${data.aws_partition.current.partition}:iam::${n}:root"] : []
810
}
911

1012
# Policy used by both private and public repositories
@@ -129,4 +131,85 @@ data "aws_iam_policy_document" "repository" {
129131
]
130132
}
131133
}
134+
135+
dynamic "statement" {
136+
for_each = length(local.aws_ecr_repo_write_arn) > 0 && var.aws_ecr_repo_type == "public" ? [local.aws_ecr_repo_write_arn] : []
137+
138+
content {
139+
sid = "ReadWrite"
140+
141+
principals {
142+
type = "AWS"
143+
identifiers = statement.value
144+
}
145+
146+
actions = [
147+
"ecr-public:BatchCheckLayerAvload",
148+
"ecr-public:CompleteLayerUpload",
149+
"ecr-public:InitiateLayerUpload",
150+
"ecr-public:PutImage",
151+
"ecr-public:UploadLayerPart",
152+
]
153+
}
154+
}
155+
156+
dynamic "statement" {
157+
for_each = length(local.aws_ecr_repo_read_external_aws_account) > 0 && var.aws_ecr_repo_type == "private" ? [local.aws_ecr_repo_read_external_aws_account] : []
158+
159+
content {
160+
sid = "ExternalAccountReadOnly"
161+
162+
principals {
163+
type = "AWS"
164+
identifiers = statement.value
165+
}
166+
167+
actions = [
168+
"ecr:GetAuthorizationToken",
169+
"ecr:BatchCheckLayerAvailability",
170+
"ecr:BatchGetImage",
171+
"ecr:DescribeImageScanFindings",
172+
"ecr:DescribeImages",
173+
"ecr:DescribeRepositories",
174+
"ecr:GetDownloadUrlForLayer",
175+
"ecr:GetLifecyclePolicy",
176+
"ecr:GetLifecyclePolicyPreview",
177+
"ecr:GetRepositoryPolicy",
178+
"ecr:ListImages",
179+
"ecr:ListTagsForResource",
180+
]
181+
}
182+
}
183+
184+
dynamic "statement" {
185+
for_each = length(local.aws_ecr_repo_write_external_aws_account) > 0 && var.aws_ecr_repo_type == "private" ? [local.aws_ecr_repo_write_external_aws_account] : []
186+
187+
content {
188+
sid = "ExternalAccountReadWrite"
189+
190+
principals {
191+
type = "AWS"
192+
identifiers = statement.value
193+
}
194+
195+
actions = [
196+
"ecr:GetAuthorizationToken",
197+
"ecr:BatchCheckLayerAvailability",
198+
"ecr:BatchGetImage",
199+
"ecr:DescribeImageScanFindings",
200+
"ecr:DescribeImages",
201+
"ecr:DescribeRepositories",
202+
"ecr:GetDownloadUrlForLayer",
203+
"ecr:GetLifecyclePolicy",
204+
"ecr:GetLifecyclePolicyPreview",
205+
"ecr:GetRepositoryPolicy",
206+
"ecr:ListImages",
207+
"ecr:ListTagsForResource",
208+
"ecr:PutImage",
209+
"ecr:InitiateLayerUpload",
210+
"ecr:UploadLayerPart",
211+
"ecr:CompleteLayerUpload",
212+
]
213+
}
214+
}
132215
}

‎operations/deployment/terraform/modules/aws/ecr/aws_ecr_vars.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ variable "aws_ecr_repo_policy_create" {}
1515
variable "aws_ecr_repo_policy_input" {}
1616
variable "aws_ecr_repo_read_arn" {}
1717
variable "aws_ecr_repo_write_arn" {}
18+
variable "aws_ecr_repo_read_external_aws_account" {}
19+
variable "aws_ecr_repo_write_external_aws_account" {}
1820
variable "aws_ecr_repo_read_arn_lambda" {}
1921
variable "aws_ecr_lifecycle_policy_input" {}
2022
variable "aws_ecr_public_repo_catalog" {}

0 commit comments

Comments
 (0)