About

This creates private container image repositories hosted in the AWS Elastic Container Registry (ECR) of your AWS Account using a cdktf program.

For equivalent examples see:

• terraform
• pulumi (aws classic provider)
• pulumi (aws native provider)

Usage (on a Ubuntu Desktop)

Install the dependencies:

• AWS CLI.
• Crane.

Install cdktf into your home directory:

npm config set prefix ~/.npm/global
export PATH="~/.npm/global/bin:$PATH"
# see https://developer.hashicorp.com/terraform/tutorials/cdktf/cdktf-install
# see https://www.npmjs.com/package/cdktf-cli
npm install --global cdktf-cli@0.20.1
cdktf --version

This project was initially initialized as:

NB Do NOT actually execute this, as this project is already initialized. This is here for documentation purposes ONLY.

mkdir cdktf-typescript-aws-ecr-example
cd cdktf-typescript-aws-ecr-example
cdktf init \
  --template=typescript \
  --local \
  --providers=hashicorp/aws \
  --project-name=cdktf-typescript-aws-ecr-example \
  --project-description='Create private container images repositories hosted in ECR.'
rm -rf help
git init
git add .

Install this project dependencies:

npm ci
cdktf get

Set the AWS Account credentials using SSO:

# set the account credentials.
# see https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html#sso-configure-profile-token-auto-sso
aws configure sso
# dump the configured profile and sso-session.
cat ~/.aws/config
# set the environment variables to use a specific profile.
export AWS_PROFILE=my-profile
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_DEFAULT_REGION
# show the user, user amazon resource name (arn), and the account id, of the
# profile set in the AWS_PROFILE environment variable.
aws sts get-caller-identity

Or, set the account credentials using an access key:

# set the account credentials.
# NB get these from your aws account iam console.
#    see Managing access keys (console) at
#        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey
export AWS_ACCESS_KEY_ID='TODO'
export AWS_SECRET_ACCESS_KEY='TODO'
# set the default region.
export AWS_DEFAULT_REGION='eu-west-1'
# show the user, user amazon resource name (arn), and the account id.
aws sts get-caller-identity

Review main.ts.

Deploy the project:

cdktf deploy

Go to the AWS Management Console, open the ECR Container Registry service page, and see the create repositories and images.

Destroy the project:

cdktf destroy

Notes

• I'm surprised that a TypeScript string is not automatically escaped when its translated to terraform code. I have very mix feelings about this behavior.
  • See hashicorp/terraform-cdk#3420.
• Find pre-built providers at https://www.npmjs.com/search?q=keywords:cdktf and add them as, e.g.: npm install @cdktf/provider-aws.

References

• Environment variables to configure the AWS CLI
• Token provider configuration with automatic authentication refresh for AWS IAM Identity Center (SSO)
• Managing access keys (console)
• AWS General Reference
  • Amazon Resource Names (ARNs)
• Amazon ECR private registry
  • Private registry authentication
• CDK for Terraform.
  • CDK for Terraform Best Practices.
  • Variables and Outputs.
  • HCL Interoperability.
  • Escape Hatch.