feat(ecr): add lifecycle policy to clean up untagged images

examples/aws-ecr-lifecycle/sst-env.d.ts

@@ -0,0 +1,9 @@
+/* This file is auto-generated by SST. Do not edit. */
+/* tslint:disable */
+/* eslint-disable */
+import "sst";
+export {};
+
+declare module "sst" {
+  export interface Resource {}
+}

examples/aws-ecr-lifecycle/sst.config.ts

@@ -0,0 +1,36 @@
+/// <reference path="./.sst/platform/config.d.ts" />
+
+/**
+ * ## ECR lifecycle policy
+ *
+ * Apply a lifecycle policy to the SST bootstrap ECR repository.
+ */
+export default $config({
+  app(input) {
+    return {
+      name: "aws-ecr-lifecycle",
+      home: "aws",
+      removal: input?.stage === "production" ? "retain" : "remove",
+    };
+  },
+  async run() {
+    new aws.ecr.LifecyclePolicy("SstAssetLifecycle", {
+      repository: sst.aws.getECRRepository().apply((repo) => repo.name),
+      policy: JSON.stringify({
+        rules: [
+          {
+            rulePriority: 1,
+            description: "Expire untagged images pushed over 30 days ago",
+            selection: {
+              tagStatus: "untagged",
+              countType: "sinceImagePushed",
+              countUnit: "days",
+              countNumber: 30,
+            },
+            action: { type: "expire" },
+          },
+        ],
+      }),
+    });
+  },
+});

platform/src/components/aws/ecr.ts

@@ -0,0 +1,42 @@
+import { output } from "@pulumi/pulumi";
+import { getRegionOutput } from "@pulumi/aws";
+import { bootstrap } from "./helpers/bootstrap";
+import { VisibleError } from "../error";
+
+export interface EcrRepositoryInfo {
+  /**
+   * The ECR repository name.
+   */
+  name: string;
+  /**
+   * The ECR repository URL.
+   */
+  url: string;
+  /**
+   * The ECR registry ID.
+   */
+  registryId: string;
+}
+
+/**
+ * Get the bootstrap ECR repository used by SST for storing assets.
+ */
+export function getECRRepository() {
+  const region = getRegionOutput().name;
+  const bootstrapData = region.apply((value) => bootstrap.forRegion(value));
+
+  return output(bootstrapData).apply((data) => {
+    const name = data.assetEcrUrl.split("/").pop();
+    if (!name) {
+      throw new VisibleError(
+        `Failed to resolve the SST asset ECR repository name from "${data.assetEcrUrl}".`,
+      );
+    }
+
+    return {
+      name,
+      url: data.assetEcrUrl,
+      registryId: data.assetEcrRegistryId,
+    } satisfies EcrRepositoryInfo;
+  });
+}

platform/src/components/aws/index.ts

@@ -14,6 +14,7 @@ export * from "./cognito-user-pool.js";
 export * from "./cron.js";
 export * from "./dns.js";
 export * from "./dynamo.js";
+export * from "./ecr.js";
 export * from "./efs.js";
 export * from "./email.js";
 export * from "./function.js";