ecr: When creating multiple repositories, the provider role only includes one in its policy

[davidcosc]

Describe the bug

When creating multiple repositories using the Repository construct in conjunction with an aws lifecycle policy, only one of the repositories is added to the CustomECRAutoDeleteImagesCustomResourceProviderRole policy resources.

Expected Behavior

Both repositories are added to the role policy resources e.g.
"Resource": [ { "Fn::GetAtt": [ "Repository15A6F32E1", "Arn" ] }, { "Fn::GetAtt": [ "Repository25C81E63B", "Arn" ] } ]

Current Behavior

Only the first repository is added to the role policy resources e.g.
"Resource": [ { "Fn::GetAtt": [ "Repository15A6F32E1", "Arn" ] } ]

Reproduction Steps

I have the following stack defined:

import { RemovalPolicy, Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Repository, TagStatus } from 'aws-cdk-lib/aws-ecr';

export class TestECRStack extends Stack {
  constructor(scope: Construct, id: string, namePrefix: string, props?: StackProps) {
    super(scope, id, props);
    const repository = new Repository(this, 'Repository1', {
      autoDeleteImages: true,
      imageScanOnPush: true,
      removalPolicy: RemovalPolicy.DESTROY,
      repositoryName: 'rep-one',
    });
    repository.addLifecycleRule({
      description: 'Delete untagged images if more than one.',
      maxImageCount: 1,
      rulePriority: 1,
      tagStatus: TagStatus.UNTAGGED,
    });
    const repository2 = new Repository(this, 'Repository2', {
      autoDeleteImages: true,
      imageScanOnPush: true,
      removalPolicy: RemovalPolicy.DESTROY,
      repositoryName: 'rep-two',
    });
    repository2.addLifecycleRule({
      description: 'Delete untagged images if more than one.',
      maxImageCount: 1,
      rulePriority: 1,
      tagStatus: TagStatus.UNTAGGED,
    });
  }
}

Using this stack e.g.

import { Stack } from "aws-cdk-lib";
import { TestECRStack } from "../lib/test-ecr-stack";
import { Template } from "aws-cdk-lib/assertions";

const rootStack = new Stack(undefined, 'TestStack');
const stack = new TestECRStack(rootStack, 'TestStack', 'blubb', {});
const template = Template.fromStack(stack);
console.log(JSON.stringify(template));

results in the following role template:

"CustomECRAutoDeleteImagesCustomResourceProviderRole665F2773": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              }
            }
          ]
        },
        "ManagedPolicyArns": [
          {
            "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
          }
        ],
        "Policies": [
          {
            "PolicyName": "Inline",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "ecr:BatchDeleteImage",
                    "ecr:DescribeRepositories",
                    "ecr:ListImages",
                    "ecr:ListTagsForResource"
                  ],
                  "Resource": [
                    {
                      "Fn::GetAtt": [
                        "Repository15A6F32E1",
                        "Arn"
                      ]
                    }
                  ]
                }
              ]
            }
          }
        ]
      }
    }

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.70.0 (build c13a0f1)

Framework Version

No response

Node.js Version

v16.18.1

OS

Amazon Linux 2

Language

Typescript

Language Version

4.9.5

Other information

No response

[pahud]

Thanks for the report. I believe we should fix the enableAutoDeleteImages() to include all repos with autoDeleteImages prop enabled.

aws-cdk/packages/aws-cdk-lib/aws-ecr/lib/repository.ts

Line 792 in 460e487

private enableAutoDeleteImages() {

[davidcosc]

Thanks a lot for the fast reply! The enableAutoDeleteImages function seems like the right place for the fix. How should i proceed with the Issue? For example, should i try to create a pull request? (Its my first time submitting a ticket so im not sure about the process yet)

[davidcosc]

The following fix seems to already solve this issue #25964 .