New Resource: aws_ecr_repository_policy_statement

[greenboxal]

This resource allows to manage ECR policy statements as single resources, allowing to spread them across several modules. This is useful as a ECR repository can have only one policy document.

It was implemented in the same way that aws_security_group_rule works: It locks the resource mutex and applies the diff (add, remove or change the statement) over the policy document and applies it on the repository.

[greenboxal]

@stack72 as discussed in #979, just improved the documentation.

[Ninir]

Hi @greenboxal

Sorry for taking this long to get back to you.
I have read the discussion in the other PR, and I am just wondering why not using the aws_ecr_repository_policy policy along with the template_file (for reusability)?

Hope I understood the use-case well 😄

THanks!

[greenboxal]

You can only apply one policy per repository. A lot of times you want to deploy the same application in different infrastructures, using the same repository. Maybe for creating a staging -> production pipeline.

Let's say you have a module called my-cool-app, and that I want to provision it twice, one for production, one for staging. Still, I want to use the same ECR repository.

If I want to use the same repository, I can't create the repo inside the module, otherwise I would end up with two different repositories. I need to create a policy for each my-cool-app module instance, so its EC2 instances can download the images from the repo.

The first approach that come to my head is: create one policy for each module instance and attach them to the repo. But then you have a issue here: ECR repos can only have one policy.

This resources solves this, in the same way that aws_security_group_rule resource solves a related issue with security groups. You can do a kind of "dependency injection".

[Ninir]

@greenboxal Do you think you could take some time to create a data source called aws_iam_policy_document which would have a source_policy document, that would allow to merge your policy into the source one?

Your use case seems totally valid and it would be a great addition to have it! 👍
I am just wondering that maybe we could make this part reusable so that we can handle this case in several situations. What do you think? :)

[devonbleak]

@Ninir this sounds almost exactly like what I did with #2890

[bflad]

I believe this will be helped/solved in a more generic sense with #2890

[bflad]

As noted above, this was solved more generically with the aws_iam_policy_document data source. 👍

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!