Repository: gruntwork-io/terratest

Issue:
Missing functionality to set and delete ECR repository policies (aka permissions)
In the same way you can set and delete ECR lifecycle policies, functions for doing the same with repository policies would come in handy for developing tests for a Terraform AWS ECR module.


Discussion:

Solution patch:
diff --git a/modules/aws/ecr.go b/modules/aws/ecr.go
index 40d4da74..06f1ac42 100644
--- a/modules/aws/ecr.go
+++ b/modules/aws/ecr.go
@@ -143,3 +143,46 @@ func PutECRRepoLifecyclePolicyE(t testing.TestingT, region string, repo *types.R
 	_, err = client.PutLifecyclePolicy(context.Background(), input)
 	return err
 }
+
+// GetECRRepoPolicy gets the permissions for the given ECR repository.
+// This will fail the test and stop execution if there is an error.
+func GetECRRepoPolicy(t testing.TestingT, region string, repo *types.Repository) string {
+	policy, err := GetECRRepoPolicyE(t, region, repo)
+	require.NoError(t, err)
+	return policy
+}
+
+// GetECRRepoPolicyE gets the policies for the given ECR repository.
+func GetECRRepoPolicyE(t testing.TestingT, region string, repo *types.Repository) (string, error) {
+	client := NewECRClient(t, region)
+	resp, err := client.GetRepositoryPolicy(context.Background(), &ecr.GetRepositoryPolicyInput{RepositoryName: repo.RepositoryName})
+	if err != nil {
+		return "", err
+	}
+	return *resp.PolicyText, nil
+}
+
+// PutECRRepoPolicy puts the given policy for the given ECR repository.
+// This will fail the test and stop execution if there is an error.
+func PutECRRepoPolicy(t testing.TestingT, region string, repo *types.Repository, policy string) {
+	err := PutECRRepoLifecyclePolicyE(t, region, repo, policy)
+	require.NoError(t, err)
+}
+
+// PutECRRepoPolicyE puts the given policy for the given ECR repository.
+func PutECRRepoPolicyE(t testing.TestingT, region string, repo *types.Repository, policy string) error {
+	logger.Default.Logf(t, "Applying repo policy for repository %s in %s", *repo.RepositoryName, region)
+
+	client, err := NewECRClientE(t, region)
+	if err != nil {
+		return err
+	}
+
+	input := &ecr.SetRepositoryPolicyInput{
+		PolicyText:     &policy,
+		RepositoryName: repo.RepositoryName,
+	}
+
+	_, err = client.SetRepositoryPolicy(context.Background(), input)
+	return err
+}



Test patch:
diff --git a/modules/aws/ecr_test.go b/modules/aws/ecr_test.go
index bc0be1d7..d77ac611 100644
--- a/modules/aws/ecr_test.go
+++ b/modules/aws/ecr_test.go
@@ -75,3 +75,34 @@ func TestCanSetECRRepoLifecyclePolicyWithSingleRule(t *testing.T) {
 	policy := GetECRRepoLifecyclePolicy(t, region, repo1)
 	assert.JSONEq(t, lifecyclePolicy, policy)
 }
+
+func TestCanSetRepositoryPolicyWithSimplePolicy(t *testing.T) {
+	t.Parallel()
+
+	region := GetRandomStableRegion(t, nil, nil)
+	ecrRepoName := fmt.Sprintf("terratest%s", strings.ToLower(random.UniqueId()))
+	repo, err := CreateECRRepoE(t, region, ecrRepoName)
+	defer DeleteECRRepo(t, region, repo)
+	require.NoError(t, err)
+
+	repositoryPolicy := `
+		{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Sid": "AllowPushPull",
+				"Effect": "Allow",
+				"Principal": {
+					"AWS": "*"
+				},
+				"Action": "ecr:*"
+			}
+		]
+	}`
+
+	err = PutECRRepoPolicyE(t, region, repo, repositoryPolicy)
+	require.NoError(t, err)
+
+	policy := GetECRRepoPolicy(t, region, repo)
+	assert.JSONEq(t, repositoryPolicy, policy)
+}