diff --git a/modules/ecr-repository/main.tf b/modules/ecr-repository/main.tf index 6d86710..b369563 100644 --- a/modules/ecr-repository/main.tf +++ b/modules/ecr-repository/main.tf @@ -14,6 +14,11 @@ locals { } : {} } + +################################################### +# ECR Repository +################################################### + resource "aws_ecr_repository" "this" { name = local.metadata.name @@ -25,8 +30,8 @@ resource "aws_ecr_repository" "this" { } encryption_configuration { - encryption_type = var.encryption_type - kms_key = var.encryption_kms_key + encryption_type = var.encryption.type + kms_key = var.encryption.kms_key } tags = merge( @@ -44,10 +49,10 @@ resource "aws_ecr_repository" "this" { ################################################### resource "aws_ecr_repository_policy" "this" { - count = length(var.repository_policy) > 0 ? 1 : 0 + count = length(var.policy) > 0 ? 1 : 0 repository = aws_ecr_repository.this.name - policy = var.repository_policy + policy = var.policy } @@ -58,30 +63,36 @@ resource "aws_ecr_repository_policy" "this" { locals { lifecycle_rules = [ for rule in var.lifecycle_rules : { - rulePriority = tonumber(rule.priority) + rulePriority = rule.priority description = rule.description - selection = merge( - { - tagStatus = rule.type - }, - try( - { - tagPrefixList = rule.tag_prefixes - }, - {} - ), - try( - { - countType = "imageCountMoreThan" - countNumber = tonumber(rule.expiration_count) - }, - { - countType = "sinceImagePushed" - countUnit = "days" - countNumber = tonumber(rule.expiration_days) - } - ) - ) + selection = { + for k, v in { + tagStatus = rule.target.status + tagPatternList = (rule.target.status == "tagged" && length(rule.target.tag_patterns) > 0 + ? rule.target.tag_patterns + : null + ) + tagPrefixList = (rule.target.status == "tagged" && length(rule.target.tag_prefixes) > 0 + ? rule.target.tag_prefixes + : null + ) + + countType = (rule.expiration.count != null + ? "imageCountMoreThan" + : "sinceImagePushed" + ) + countUnit = (rule.expiration.count != null + ? null + : "days" + ) + countNumber = (rule.expiration.count != null + ? rule.expiration.count + : rule.expiration.days + ) + } : + k => v + if v != null + } action = { type = "expire" } diff --git a/modules/ecr-repository/outputs.tf b/modules/ecr-repository/outputs.tf index 58693b4..bb80ef6 100644 --- a/modules/ecr-repository/outputs.tf +++ b/modules/ecr-repository/outputs.tf @@ -28,8 +28,13 @@ output "image_scan_on_push_enabled" { value = aws_ecr_repository.this.image_scanning_configuration[0].scan_on_push } +output "lifecycle_rules" { + description = "The lifecycle rules for the repository." + value = var.lifecycle_rules +} + output "encryption" { - description = "The configuration for the encryption of repository." + description = "The encryption configuration of the repository." value = { type = aws_ecr_repository.this.encryption_configuration[0].encryption_type kms_key = aws_ecr_repository.this.encryption_configuration[0].kms_key diff --git a/modules/ecr-repository/variables.tf b/modules/ecr-repository/variables.tf index 7ac32b1..3623ac9 100644 --- a/modules/ecr-repository/variables.tf +++ b/modules/ecr-repository/variables.tf @@ -1,71 +1,109 @@ variable "name" { description = "(Required) Desired name for the repository." type = string + nullable = false } -variable "image_tag_immutable_enabled" { - description = "(Optional) Enable tag immutability to prevent image tags from being overwritten by subsequent image pushes using the same tag. Disable tag immutability to allow image tags to be overwritten." +variable "force_delete" { + description = "(Optional) If `true`, will delete the repository even if it contains images. Defaults to `true`." type = bool - default = false + default = true nullable = false } -variable "image_scan_on_push_enabled" { - description = "(Optional, Deprecated) Indicates whether images are scanned after being pushed to the repository or not scanned." +variable "policy" { + description = "(Optional) The policy document for ECR Repository. This is a JSON formatted string." + type = string + default = "" + nullable = false +} + +variable "image_tag_immutable_enabled" { + description = "(Optional) Whether to enable the image tag immutability setting for the repository. Enable tag immutability to prevent image tags from being overwritten by subsequent image pushes using the same tag. Disable tag immutability to allow image tags to be overwritten. Defaults to `false`." type = bool default = false nullable = false } -variable "force_delete" { - description = "(Optional) If `true`, will delete the repository even if it contains images. Defaults to `false`." +variable "image_scan_on_push_enabled" { + description = "(Optional, Deprecated) Indicates whether images are scanned after being pushed to the repository or not scanned. This configuration is deprecated in favor of registry level scan filters. Defaults to `false`." type = bool default = false nullable = false } -variable "encryption_type" { - description = "(Optional) The encryption type to use for the repository. Valid values are `AES256` or `KMS`." - type = string - default = "AES256" - nullable = false +variable "encryption" { + description = <