Skip to content

Commit

Permalink
feat(ecr): grantRead on repositories (#25445)
Browse files Browse the repository at this point in the history 
Adds a grantRead method with `ecr:DescribeRepositories` and `ecr:DescribeImages` permissions. 

The use case is for something like cdk-assets, which tries to look up the repository / image name as part of the publishing step (so it doesn't publish a duplicate). 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
@kaizencc
kaizencc committed May 5, 2023
1 parent 75212eb commit ce7bdea
Show file tree
Hide file tree
Showing 10 changed files with 228 additions and 33 deletions.
6 changes: 3 additions & 3 deletions ...framework-integ/test/aws-ecr/test/integ.basic.js.snapshot/aws-ecr-integ-stack.assets.json
View file
@@ -1,15 +1,15 @@
{
"version": "30.1.0",
"version": "31.0.0",
"files": {
"26df443ecb3d9a917feccf0349d0f8852c227c138904499fe5e26de6a090654c": {
"a047e78171779d23d25e3fc35f2b3ce7ff7313e616a588b6f8773b9360f12b26": {
"source": {
"path": "aws-ecr-integ-stack.template.json",
"packaging": "file"
},
"destinations": {
"current_account-current_region": {
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
"objectKey": "26df443ecb3d9a917feccf0349d0f8852c227c138904499fe5e26de6a090654c.json",
"objectKey": "a047e78171779d23d25e3fc35f2b3ce7ff7313e616a588b6f8773b9360f12b26.json",
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
}
}
Expand Down
64 changes: 54 additions & 10 deletions ...amework-integ/test/aws-ecr/test/integ.basic.js.snapshot/aws-ecr-integ-stack.template.json
View file
Expand Up @@ -7,20 +7,64 @@
"LifecyclePolicyText": "{\"rules\":[{\"rulePriority\":1,\"selection\":{\"tagStatus\":\"any\",\"countType\":\"imageCountMoreThan\",\"countNumber\":5},\"action\":{\"type\":\"expire\"}}]}"
},
"RepositoryPolicyText": {
"Statement": [
{
"Action": "ecr:GetDownloadUrlForLayer",
"Effect": "Allow",
"Principal": {
"AWS": "*"
}
"Statement": [
{
"Action": "ecr:GetDownloadUrlForLayer",
"Effect": "Allow",
"Principal": {
"AWS": "*"
}
],
"Version": "2012-10-17"
}
}
],
"Version": "2012-10-17"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain"
},
"MyUserDC45028B": {
"Type": "AWS::IAM::User"
},
"MyUserDefaultPolicy7B897426": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:CompleteLayerUpload",
"ecr:DescribeImages",
"ecr:DescribeRepositories",
"ecr:GetDownloadUrlForLayer",
"ecr:InitiateLayerUpload",
"ecr:PutImage",
"ecr:UploadLayerPart"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"Repo02AC86CF",
"Arn"
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
},
"PolicyName": "MyUserDefaultPolicy7B897426",
"Users": [
{
"Ref": "MyUserDC45028B"
}
]
}
}
},
"Outputs": {
Expand Down
2 changes: 1 addition & 1 deletion packages/@aws-cdk-testing/framework-integ/test/aws-ecr/test/integ.basic.js.snapshot/cdk.out
View file
@@ -1 +1 @@
{"version":"30.1.0"}
{"version":"31.0.0"}
2 changes: 1 addition & 1 deletion ...t/integ.basic.js.snapshot/cdkecrintegtestbasicDefaultTestDeployAssert4F7FBFB4.assets.json
View file
@@ -1,5 +1,5 @@
{
"version": "30.1.0",
"version": "31.0.0",
"files": {
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
"source": {
Expand Down
2 changes: 1 addition & 1 deletion ...ges/@aws-cdk-testing/framework-integ/test/aws-ecr/test/integ.basic.js.snapshot/integ.json
View file
@@ -1,5 +1,5 @@
{
"version": "30.1.0",
"version": "31.0.0",
"testCases": {
"cdk-ecr-integ-test-basic/DefaultTest": {
"stacks": [
Expand Down
16 changes: 14 additions & 2 deletions .../@aws-cdk-testing/framework-integ/test/aws-ecr/test/integ.basic.js.snapshot/manifest.json
View file
@@ -1,5 +1,5 @@
{
"version": "30.1.0",
"version": "31.0.0",
"artifacts": {
"aws-ecr-integ-stack.assets": {
"type": "cdk:asset-manifest",
Expand All @@ -17,7 +17,7 @@
"validateOnSynth": false,
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/26df443ecb3d9a917feccf0349d0f8852c227c138904499fe5e26de6a090654c.json",
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/a047e78171779d23d25e3fc35f2b3ce7ff7313e616a588b6f8773b9360f12b26.json",
"requiresBootstrapStackVersion": 6,
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
"additionalDependencies": [
Expand All @@ -39,6 +39,18 @@
"data": "Repo02AC86CF"
}
],
"/aws-ecr-integ-stack/MyUser/Resource": [
{
"type": "aws:cdk:logicalId",
"data": "MyUserDC45028B"
}
],
"/aws-ecr-integ-stack/MyUser/DefaultPolicy/Resource": [
{
"type": "aws:cdk:logicalId",
"data": "MyUserDefaultPolicy7B897426"
}
],
"/aws-ecr-integ-stack/RepositoryURI": [
{
"type": "aws:cdk:logicalId",
Expand Down
121 changes: 107 additions & 14 deletions ...ages/@aws-cdk-testing/framework-integ/test/aws-ecr/test/integ.basic.js.snapshot/tree.json
View file
Expand Up @@ -20,47 +20,140 @@
"aws:cdk:cloudformation:props": {
"lifecyclePolicy": {
"lifecyclePolicyText": "{\"rules\":[{\"rulePriority\":1,\"selection\":{\"tagStatus\":\"any\",\"countType\":\"imageCountMoreThan\",\"countNumber\":5},\"action\":{\"type\":\"expire\"}}]}"
},
"repositoryPolicyText": {
"Statement": [
{
"Action": "ecr:GetDownloadUrlForLayer",
"Effect": "Allow",
"Principal": {
"AWS": "*"
}
}
],
"Version": "2012-10-17"
}
}
},
"constructInfo": {
"fqn": "@aws-cdk/aws-ecr.CfnRepository",
"fqn": "aws-cdk-lib.aws_ecr.CfnRepository",
"version": "0.0.0"
}
}
},
"constructInfo": {
"fqn": "@aws-cdk/aws-ecr.Repository",
"fqn": "aws-cdk-lib.aws_ecr.Repository",
"version": "0.0.0"
}
},
"MyUser": {
"id": "MyUser",
"path": "aws-ecr-integ-stack/MyUser",
"children": {
"Resource": {
"id": "Resource",
"path": "aws-ecr-integ-stack/MyUser/Resource",
"attributes": {
"aws:cdk:cloudformation:type": "AWS::IAM::User",
"aws:cdk:cloudformation:props": {}
},
"constructInfo": {
"fqn": "aws-cdk-lib.aws_iam.CfnUser",
"version": "0.0.0"
}
},
"DefaultPolicy": {
"id": "DefaultPolicy",
"path": "aws-ecr-integ-stack/MyUser/DefaultPolicy",
"children": {
"Resource": {
"id": "Resource",
"path": "aws-ecr-integ-stack/MyUser/DefaultPolicy/Resource",
"attributes": {
"aws:cdk:cloudformation:type": "AWS::IAM::Policy",
"aws:cdk:cloudformation:props": {
"policyDocument": {
"Statement": [
{
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:CompleteLayerUpload",
"ecr:DescribeImages",
"ecr:DescribeRepositories",
"ecr:GetDownloadUrlForLayer",
"ecr:InitiateLayerUpload",
"ecr:PutImage",
"ecr:UploadLayerPart"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"Repo02AC86CF",
"Arn"
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
},
"policyName": "MyUserDefaultPolicy7B897426",
"users": [
{
"Ref": "MyUserDC45028B"
}
]
}
},
"constructInfo": {
"fqn": "aws-cdk-lib.aws_iam.CfnPolicy",
"version": "0.0.0"
}
}
},
"constructInfo": {
"fqn": "aws-cdk-lib.aws_iam.Policy",
"version": "0.0.0"
}
}
},
"constructInfo": {
"fqn": "aws-cdk-lib.aws_iam.User",
"version": "0.0.0"
}
},
"RepositoryURI": {
"id": "RepositoryURI",
"path": "aws-ecr-integ-stack/RepositoryURI",
"constructInfo": {
"fqn": "@aws-cdk/core.CfnOutput",
"fqn": "aws-cdk-lib.CfnOutput",
"version": "0.0.0"
}
},
"BootstrapVersion": {
"id": "BootstrapVersion",
"path": "aws-ecr-integ-stack/BootstrapVersion",
"constructInfo": {
"fqn": "@aws-cdk/core.CfnParameter",
"fqn": "aws-cdk-lib.CfnParameter",
"version": "0.0.0"
}
},
"CheckBootstrapVersion": {
"id": "CheckBootstrapVersion",
"path": "aws-ecr-integ-stack/CheckBootstrapVersion",
"constructInfo": {
"fqn": "@aws-cdk/core.CfnRule",
"fqn": "aws-cdk-lib.CfnRule",
"version": "0.0.0"
}
}
},
"constructInfo": {
"fqn": "@aws-cdk/core.Stack",
"fqn": "aws-cdk-lib.Stack",
"version": "0.0.0"
}
},
Expand All @@ -77,7 +170,7 @@
"path": "cdk-ecr-integ-test-basic/DefaultTest/Default",
"constructInfo": {
"fqn": "constructs.Construct",
"version": "10.1.252"
"version": "10.1.270"
}
},
"DeployAssert": {
Expand All @@ -88,33 +181,33 @@
"id": "BootstrapVersion",
"path": "cdk-ecr-integ-test-basic/DefaultTest/DeployAssert/BootstrapVersion",
"constructInfo": {
"fqn": "@aws-cdk/core.CfnParameter",
"fqn": "aws-cdk-lib.CfnParameter",
"version": "0.0.0"
}
},
"CheckBootstrapVersion": {
"id": "CheckBootstrapVersion",
"path": "cdk-ecr-integ-test-basic/DefaultTest/DeployAssert/CheckBootstrapVersion",
"constructInfo": {
"fqn": "@aws-cdk/core.CfnRule",
"fqn": "aws-cdk-lib.CfnRule",
"version": "0.0.0"
}
}
},
"constructInfo": {
"fqn": "@aws-cdk/core.Stack",
"fqn": "aws-cdk-lib.Stack",
"version": "0.0.0"
}
}
},
"constructInfo": {
"fqn": "@aws-cdk/integ-tests.IntegTestCase",
"fqn": "@aws-cdk/integ-tests-alpha.IntegTestCase",
"version": "0.0.0"
}
}
},
"constructInfo": {
"fqn": "@aws-cdk/integ-tests.IntegTest",
"fqn": "@aws-cdk/integ-tests-alpha.IntegTest",
"version": "0.0.0"
}
},
Expand All @@ -123,12 +216,12 @@
"path": "Tree",
"constructInfo": {
"fqn": "constructs.Construct",
"version": "10.1.252"
"version": "10.1.270"
}
}
},
"constructInfo": {
"fqn": "@aws-cdk/core.App",
"fqn": "aws-cdk-lib.App",
"version": "0.0.0"
}
}
Expand Down
4 changes: 4 additions & 0 deletions packages/@aws-cdk-testing/framework-integ/test/aws-ecr/test/integ.basic.ts
View file
Expand Up @@ -13,6 +13,10 @@ repo.addToResourcePolicy(new iam.PolicyStatement({
principals: [new iam.AnyPrincipal()],
}));

const user = new iam.User(stack, 'MyUser');
repo.grantRead(user);
repo.grantPullPush(user);

new cdk.CfnOutput(stack, 'RepositoryURI', {
value: repo.repositoryUri,
});
Expand Down

0 comments on commit ce7bdea

Please sign in to comment.