repositories

Creates, updates, deletes or gets a repository resource or lists repositories in a region

Overview

Name	repositories
Type	Resource
Description	The AWS::ECR::Repository resource specifies an Amazon Elastic Container Registry (Amazon ECR) repository, where users can push and pull Docker images, Open Container Initiative (OCI) images, and OCI compatible artifacts. For more information, see Amazon ECR private repositories in the Amazon ECR User Guide.
Id	awscc.ecr.repositories

Fields

get (all properties)

Name	Datatype	Description
empty_on_delete	boolean	If true, deleting the repository force deletes the contents of the repository. If false, the repository must be empty before attempting to delete it.
▶lifecycle_policy	object	Creates or updates a lifecycle policy. For information about lifecycle policy syntax, see Lifecycle policy template.
repository_name	string	The name to use for the repository. The repository name may be specified on its own (such as nginx-web-app) or it can be prepended with a namespace to group the repository into a category (such as project-a/nginx-web-app). If you don't specify a name, CFNlong generates a unique physical ID and uses that ID for the repository name. For more information, see Name type. The repository name must start with a letter and can only contain lowercase letters, numbers, hyphens, underscores, and forward slashes. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
repository_policy_text	object	The JSON repository policy text to apply to the repository. For more information, see Amazon ECR repository policies in the Amazon Elastic Container Registry User Guide.
▶tags	array	An array of key-value pairs to apply to this resource.
arn	string
repository_uri	string
image_tag_mutability	string	The tag mutability setting for the repository. If this parameter is omitted, the default setting of MUTABLE will be used which will allow image tags to be overwritten. If IMMUTABLE is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
▶image_tag_mutability_exclusion_filters	array	The image tag mutability exclusion filters associated with the repository. These filters specify which image tags can override the repository's default image tag mutability setting.
▶image_scanning_configuration	object	The image scanning configuration for the repository. This determines whether images are scanned for known vulnerabilities after being pushed to the repository.
▶encryption_configuration	object	The encryption configuration for the repository. This determines how the contents of your repository are encrypted at rest.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
repository_name	string	The name to use for the repository. The repository name may be specified on its own (such as nginx-web-app) or it can be prepended with a namespace to group the repository into a category (such as project-a/nginx-web-app). If you don't specify a name, CFNlong generates a unique physical ID and uses that ID for the repository name. For more information, see Name type. The repository name must start with a letter and can only contain lowercase letters, numbers, hyphens, underscores, and forward slashes. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
region	string	AWS region.

For more information, see AWS::ECR::Repository.

Methods

Name	Resource	Accessible by	Required Params
create_resource	repositories	INSERT	region
delete_resource	repositories	DELETE	Identifier, region
update_resource	repositories	UPDATE	Identifier, PatchDocument, region
list_resources	repositories_list_only	SELECT	region
get_resource	repositories	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual repository.

SELECT
  region,
  empty_on_delete,
  lifecycle_policy,
  repository_name,
  repository_policy_text,
  tags,
  arn,
  repository_uri,
  image_tag_mutability,
  image_tag_mutability_exclusion_filters,
  image_scanning_configuration,
  encryption_configuration
FROM awscc.ecr.repositories
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ repository_name }}';

list (identifiers only)

Lists all repositories in a region.

SELECT
  region,
  repository_name
FROM awscc.ecr.repositories_list_only
WHERE
  region = '{{ region }}';

INSERT example

Use the following StackQL query and manifest file to create a new repository resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.ecr.repositories (
  EmptyOnDelete,
  LifecyclePolicy,
  RepositoryName,
  RepositoryPolicyText,
  Tags,
  ImageTagMutability,
  ImageTagMutabilityExclusionFilters,
  ImageScanningConfiguration,
  EncryptionConfiguration,
  region
)
SELECT
  '{{ empty_on_delete }}',
  '{{ lifecycle_policy }}',
  '{{ repository_name }}',
  '{{ repository_policy_text }}',
  '{{ tags }}',
  '{{ image_tag_mutability }}',
  '{{ image_tag_mutability_exclusion_filters }}',
  '{{ image_scanning_configuration }}',
  '{{ encryption_configuration }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

All Properties

/*+ create */
INSERT INTO awscc.ecr.repositories (
  EmptyOnDelete,
  LifecyclePolicy,
  RepositoryName,
  RepositoryPolicyText,
  Tags,
  ImageTagMutability,
  ImageTagMutabilityExclusionFilters,
  ImageScanningConfiguration,
  EncryptionConfiguration,
  region
)
SELECT
  '{{ empty_on_delete }}',
  '{{ lifecycle_policy }}',
  '{{ repository_name }}',
  '{{ repository_policy_text }}',
  '{{ tags }}',
  '{{ image_tag_mutability }}',
  '{{ image_tag_mutability_exclusion_filters }}',
  '{{ image_scanning_configuration }}',
  '{{ encryption_configuration }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Manifest

version: 1
name: stack name
description: stack description
providers:
- aws
globals:
- name: region
  value: '{{ vars.AWS_REGION }}'
resources:
- name: repository
  props:
    - name: empty_on_delete
      value: '{{ empty_on_delete }}'
    - name: lifecycle_policy
      value:
        lifecycle_policy_text: '{{ lifecycle_policy_text }}'
        registry_id: '{{ registry_id }}'
    - name: repository_name
      value: '{{ repository_name }}'
    - name: repository_policy_text
      value: {}
    - name: tags
      value:
        - key: '{{ key }}'
          value: '{{ value }}'
    - name: image_tag_mutability
      value: '{{ image_tag_mutability }}'
    - name: image_tag_mutability_exclusion_filters
      value:
        - image_tag_mutability_exclusion_filter_type: '{{ image_tag_mutability_exclusion_filter_type }}'
          image_tag_mutability_exclusion_filter_value: '{{ image_tag_mutability_exclusion_filter_value }}'
    - name: image_scanning_configuration
      value:
        scan_on_push: '{{ scan_on_push }}'
    - name: encryption_configuration
      value:
        encryption_type: '{{ encryption_type }}'
        kms_key: '{{ kms_key }}'

UPDATE example

Use the following StackQL query and manifest file to update a repository resource, using stack-deploy.

/*+ update */
UPDATE awscc.ecr.repositories
SET PatchDocument = string('{{ {
    "EmptyOnDelete": empty_on_delete,
    "LifecyclePolicy": lifecycle_policy,
    "RepositoryPolicyText": repository_policy_text,
    "Tags": tags,
    "ImageTagMutability": image_tag_mutability,
    "ImageTagMutabilityExclusionFilters": image_tag_mutability_exclusion_filters,
    "ImageScanningConfiguration": image_scanning_configuration
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ repository_name }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

DELETE example

/*+ delete */
DELETE FROM awscc.ecr.repositories
WHERE
  Identifier = '{{ repository_name }}' AND
  region = '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Additional Parameters

Mutable resources in the Cloud Control provider support additional optional parameters which can be supplied with INSERT, UPDATE, or DELETE operations. These include:

Parameter	Description
ClientToken	A unique identifier to ensure the idempotency of the resource request. This allows the provider to accurately distinguish between retries and new requests. A client token is valid for 36 hours once used. After that, a resource request with the same client token is treated as a new request. If you do not specify a client token, one is generated for inclusion in the request.
RoleArn	The ARN of the IAM role used to perform this resource operation. The role specified must have the permissions required for this operation. If you do not specify a role, a temporary session is created using your AWS user credentials.
TypeVersionId	For private resource types, the type version to use in this resource operation. If you do not specify a resource version, the default version is used.

Permissions

To operate on the repositories resource, the following permissions are required:

Create

ecr:CreateRepository,
ecr:PutLifecyclePolicy,
ecr:SetRepositoryPolicy,
ecr:TagResource,
kms:DescribeKey,
kms:CreateGrant,
kms:RetireGrant

Read

ecr:DescribeRepositories,
ecr:GetLifecyclePolicy,
ecr:GetRepositoryPolicy,
ecr:ListTagsForResource

Update

ecr:DescribeRepositories,
ecr:PutLifecyclePolicy,
ecr:SetRepositoryPolicy,
ecr:TagResource,
ecr:UntagResource,
ecr:DeleteLifecyclePolicy,
ecr:DeleteRepositoryPolicy,
ecr:PutImageScanningConfiguration,
ecr:PutImageTagMutability,
kms:DescribeKey,
kms:CreateGrant,
kms:RetireGrant

Delete

ecr:DeleteRepository,
kms:RetireGrant

List

ecr:DescribeRepositories