Package: aws-cdk.aws-ecr
Amazon ECR Construct Library---AWS CDK v1 has reached End-of-Support on 2023-06-01.
This package is no longer being updated, and users should migrate to AWS CDK v2.For more information on how to migrate, see theMigrating to AWS CDK v2guide.This package contains constructs for working with Amazon Elastic Container Registry.RepositoriesDefine a repository by creating a new instance ofRepository. A repository
holds multiple verions of a single container image.repository=ecr.Repository(self,"Repository")Image scanningAmazon ECR image scanning helps in identifying software vulnerabilities in your container images. You can manually scan container images stored in Amazon ECR, or you can configure your repositories to scan images when you push them to a repository. To create a new repository to scan on push, simply enableimageScanOnPushin the propertiesrepository=ecr.Repository(self,"Repo",image_scan_on_push=True)To create anonImageScanCompletedevent rule and trigger the event target# repository: ecr.Repository# target: SomeTargetrepository.on_image_scan_completed("ImageScanComplete").add_target(target)Authorization TokenBesides the Amazon ECR APIs, ECR also allows the Docker CLI or a language-specific Docker library to push and pull
images from an ECR repository. However, the Docker CLI does not support native IAM authentication methods and
additional steps must be taken so that Amazon ECR can authenticate and authorize Docker push and pull requests.
More information can be found at atRegistry Authentication.A Docker authorization token can be obtained using theGetAuthorizationTokenECR API. The following code snippets
grants an IAM user access to call this API.user=iam.User(self,"User")ecr.AuthorizationToken.grant_read(user)If you access images in thePublic ECR Galleryas well, it is recommended you authenticate to the registry to benefit from
higher rate and bandwidth limits.SeePricinginhttps://aws.amazon.com/blogs/aws/amazon-ecr-public-a-new-public-container-registry/andService quotas.The following code snippet grants an IAM user access to retrieve an authorization token for the public gallery.user=iam.User(self,"User")ecr.PublicGalleryAuthorizationToken.grant_read(user)This user can then proceed to login to the registry using one of theauthentication methods.Image tag immutabilityYou can set tag immutability on images in our repository using theimageTagMutabilityconstruct prop.ecr.Repository(self,"Repo",image_tag_mutability=ecr.TagMutability.IMMUTABLE)EncryptionBy default, Amazon ECR uses server-side encryption with Amazon S3-managed encryption keys which encrypts your data at rest using an AES-256 encryption algorithm. For more control over the encryption for your Amazon ECR repositories, you can use server-side encryption with KMS keys stored in AWS Key Management Service (AWS KMS). Read more about this feature in theECR Developer Guide.When you use AWS KMS to encrypt your data, you can either use the default AWS managed key, which is managed by Amazon ECR, by specifyingRepositoryEncryption.KMSin theencryptionproperty. Or specify your own customer managed KMS key, by specifying theencryptionKeyproperty.WhenencryptionKeyis set, theencryptionproperty must beKMSor empty.In the caseencryptionis set toKMSbut noencryptionKeyis set, an AWS managed KMS key is used.ecr.Repository(self,"Repo",encryption=ecr.RepositoryEncryption.KMS)Otherwise, a customer-managed KMS key is used ifencryptionKeywas set andencryptionwas optionally set toKMS.importaws_cdk.aws_kmsaskmsecr.Repository(self,"Repo",encryption_key=kms.Key(self,"Key"))Automatically clean up repositoriesYou can set life cycle rules to automatically clean up old images from your
repository. The first life cycle rule that matches an image will be applied
against that image. For example, the following deletes images older than
30 days, while keeping all images tagged with prod (note that the order
is important here):# repository: ecr.Repositoryrepository.add_lifecycle_rule(tag_prefix_list=["prod"],max_image_count=9999)repository.add_lifecycle_rule(max_image_age=Duration.days(30))