Amazon ECR Construct Library
AWS CDK v1 has reached End-of-Support on 2023-06-01. This package is no longer being updated, and users should migrate to AWS CDK v2.
For more information on how to migrate, see the Migrating to AWS CDK v2 guide.
This package contains constructs for working with Amazon Elastic Container Registry.
Define a repository by creating a new instance of
Repository. A repository
holds multiple verions of a single container image.
Repository repository = new Repository(this, "Repository");
Amazon ECR image scanning helps in identifying software vulnerabilities in your container images. You can manually scan container images stored in Amazon ECR, or you can configure your repositories to scan images when you push them to a repository. To create a new repository to scan on push, simply enable
imageScanOnPush in the properties
Repository repository = Repository.Builder.create(this, "Repo") .imageScanOnPush(true) .build();
To create an
onImageScanCompleted event rule and trigger the event target
Repository repository; SomeTarget target; repository.onImageScanCompleted("ImageScanComplete").addTarget(target);
Besides the Amazon ECR APIs, ECR also allows the Docker CLI or a language-specific Docker library to push and pull images from an ECR repository. However, the Docker CLI does not support native IAM authentication methods and additional steps must be taken so that Amazon ECR can authenticate and authorize Docker push and pull requests. More information can be found at at Registry Authentication.
A Docker authorization token can be obtained using the
GetAuthorizationToken ECR API. The following code snippets
grants an IAM user access to call this API.
User user = new User(this, "User"); AuthorizationToken.grantRead(user);
If you access images in the Public ECR Gallery as well, it is recommended you authenticate to the registry to benefit from higher rate and bandwidth limits.
Pricingin https://aws.amazon.com/blogs/aws/amazon-ecr-public-a-new-public-container-registry/ and Service quotas.
The following code snippet grants an IAM user access to retrieve an authorization token for the public gallery.
User user = new User(this, "User"); PublicGalleryAuthorizationToken.grantRead(user);
This user can then proceed to login to the registry using one of the authentication methods.
Image tag immutability
You can set tag immutability on images in our repository using the
imageTagMutability construct prop.
By default, Amazon ECR uses server-side encryption with Amazon S3-managed encryption keys which encrypts your data at rest using an AES-256 encryption algorithm. For more control over the encryption for your Amazon ECR repositories, you can use server-side encryption with KMS keys stored in AWS Key Management Service (AWS KMS). Read more about this feature in the ECR Developer Guide.
When you use AWS KMS to encrypt your data, you can either use the default AWS managed key, which is managed by Amazon ECR, by specifying
RepositoryEncryption.KMS in the
encryption property. Or specify your own customer managed KMS key, by specifying the
encryptionKey is set, the
encryption property must be
KMS or empty.
In the case
encryption is set to
KMS but no
encryptionKey is set, an AWS managed KMS key is used.
Repository.Builder.create(this, "Repo") .encryption(RepositoryEncryption.KMS) .build();
Otherwise, a customer-managed KMS key is used if
encryptionKey was set and
encryption was optionally set to
import software.amazon.awscdk.services.kms.*; Repository.Builder.create(this, "Repo") .encryptionKey(new Key(this, "Key")) .build();
Automatically clean up repositories
You can set life cycle rules to automatically clean up old images from your repository. The first life cycle rule that matches an image will be applied against that image. For example, the following deletes images older than 30 days, while keeping all images tagged with prod (note that the order is important here):
Deprecated: AWS CDK v1 has reached End-of-Support on 2023-06-01. This package is no longer being updated, and users should migrate to AWS CDK v2. For more information on how to migrate, see https://docs.aws.amazon.com/cdk/v2/guide/migrating-v2.htmlRepository repository; repository.addLifecycleRule(LifecycleRule.builder().tagPrefixList(List.of("prod")).maxImageCount(9999).build()); repository.addLifecycleRule(LifecycleRule.builder().maxImageAge(Duration.days(30)).build());
ClassDescriptionAuthorization token to access private ECR repositories in the current environment via Docker CLI.A CloudFormation
AWS::ECR::PublicRepository.A fluent builder for
CfnPublicRepository.Example:A builder for
CfnPublicRepository.RepositoryCatalogDataPropertyAn implementation for
CfnPublicRepository.RepositoryCatalogDataPropertyProperties for defining a
CfnPublicRepository.A builder for
CfnPublicRepositoryPropsAn implementation for
AWS::ECR::PullThroughCacheRule.A fluent builder for
CfnPullThroughCacheRule.Properties for defining a
CfnPullThroughCacheRule.A builder for
CfnPullThroughCacheRulePropsAn implementation for
AWS::ECR::RegistryPolicy.A fluent builder for
CfnRegistryPolicy.Properties for defining a
CfnRegistryPolicy.A builder for
CfnRegistryPolicyPropsAn implementation for
AWS::ECR::ReplicationConfiguration.A fluent builder for
CfnReplicationConfiguration.The replication configuration for a registry.An implementation for
CfnReplicationConfiguration.ReplicationConfigurationPropertyAn array of objects representing the destination for a replication rule.An implementation for
CfnReplicationConfiguration.ReplicationDestinationPropertyAn array of objects representing the replication destinations and repository filters for a replication configuration.A builder for
CfnReplicationConfiguration.ReplicationRulePropertyAn implementation for
CfnReplicationConfiguration.ReplicationRulePropertyThe filter settings used with image replication.A builder for
CfnReplicationConfiguration.RepositoryFilterPropertyAn implementation for
CfnReplicationConfiguration.RepositoryFilterPropertyProperties for defining a
CfnReplicationConfiguration.A builder for
CfnReplicationConfigurationPropsAn implementation for
AWS::ECR::Repository.A fluent builder for
CfnRepository.The encryption configuration for the repository.A builder for
CfnRepository.EncryptionConfigurationPropertyAn implementation for
CfnRepository.EncryptionConfigurationPropertyThe image scanning configuration for a repository.A builder for
CfnRepository.ImageScanningConfigurationPropertyAn implementation for
LifecyclePolicyproperty type specifies a lifecycle policy.A builder for
CfnRepository.LifecyclePolicyPropertyAn implementation for
CfnRepository.LifecyclePolicyPropertyProperties for defining a
CfnRepository.A builder for
CfnRepositoryPropsAn implementation for
CfnRepositoryPropsRepresents an ECR repository.Internal default implementation for
LifecycleRuleAn implementation for
LifecycleRuleOptions for the onCloudTrailImagePushed method.A builder for
OnCloudTrailImagePushedOptionsAn implementation for
OnCloudTrailImagePushedOptionsOptions for the OnImageScanCompleted method.A builder for
OnImageScanCompletedOptionsAn implementation for
OnImageScanCompletedOptionsAuthorization token to access the global public ECR Gallery via Docker CLI.Define an ECR repository.A fluent builder for
Repository.Example:A builder for
RepositoryAttributesAn implementation for
RepositoryAttributesBase class for ECR repository.Indicates whether server-side encryption is enabled for the object, and whether that encryption is from the AWS Key Management Service (AWS KMS) or from Amazon S3 managed encryption (SSE-S3).Example:A builder for
RepositoryPropsAn implementation for
RepositoryPropsThe tag mutability setting for your repository.Select images based on tags.