Add 'aws_ecr_image' datasource

[alexrudd]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Changes proposed in this pull request:

• Add a new datasource aws_ecr_image that maps to the DescribeImages API

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSEcrDataSource_ecrImage'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -parallel 20 -run=TestAccAWSEcrDataSource_ecrImage -timeout 120m
?       github.com/terraform-providers/terraform-provider-aws   [no test files]
=== RUN   TestAccAWSEcrDataSource_ecrImage
=== PAUSE TestAccAWSEcrDataSource_ecrImage
=== CONT  TestAccAWSEcrDataSource_ecrImage
--- PASS: TestAccAWSEcrDataSource_ecrImage (20.28s)
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws       20.330s

Hello!

I've written a datasource for ECR images, but i'm not sure how to write acceptance tests for it. To test it works I'd need to create an ecr repository (fine), then docker push an image to it (???), and then test my data source.

Does anyone have any suggestions for how I should do this?

Thanks.

EDIT:

Have added tests in which the new data source is used twice: once to lookup the public "amazonlinux" image by the "latest" tag; and a second time to look up the same image but by the digest returned from the first lookup.

Mostly the checks are just to see if the attributes are set, except for the image_tags attribute which is checked for the presence of the "latest" tag.

[bflad]

Hi @alexrudd 👋 Thanks for submitting this. For the testing you might find its easier to instead reference an image that is generally available across regions, like the Amazon Linux Container Images instead of attempting to create an ECR repository and upload an image for testing. In my brief testing, the Amazon Linux image appears to come from registry ID 137112412989 in both us-west-2 (acceptance testing default) and us-east-2 (just to check another region):

$ aws ecr list-images --region us-west-2 --registry-id 137112412989 --repository-name amazonlinux | jq '.imageIds | length'
46
$ aws ecr list-images --region us-east-2 --registry-id 137112412989 --repository-name amazonlinux | jq '.imageIds | length'
46

[alexrudd]

For the testing you might find its easier to instead reference an image that is generally available across regions, like the Amazon Linux Container Images

Awesome, thanks! I didn't know there were public images like that. Will give this a go.

[soleares]

@alexrudd This is great. Would it be possible to add the image sha to the attributes as well. That's the use case I'm looking at this for.

[alexrudd]

@alexrudd This is great. Would it be possible to add the image sha to the attributes as well. That's the use case I'm looking at this for.

Hi @soleares, isn't the image sha the same as the image digest? ie: sha256:8c27f34545fd8d4e720b050824aca4b169ec4d5df395a5482a1c5d1571f37c64. In which case you can look such an image up by using the image_digest attribute.

[soleares]

@alexrudd yes, my mistake. That's what I needed. Thanks!

[bflad]

Thanks for the updates, @alexrudd! This looks pretty good so pulling this in. I left two notes about potential improvements for the future (nothing preventing an initial release of the data source) and covering the two conversion function related items on merge just to prevent some potential Go panics. Thanks again! 🚀

Output from acceptance testing:

--- PASS: TestAccAWSEcrDataSource_ecrImage (14.26s)
--- PASS: TestAccAWSEcrDataSource_ecrRepository (17.23s)

[bflad]

In a future update of this data source: we should likely remove this validation since in Terraform 0.11 it may be helpful to define this data source as part of a Terraform module that uses an optional variable to override image lookup and the below d.GetOk() usage will skip "" automatically.

variable "registry_id" {
  default = ""
}

data "aws_ecr_image" "example" {
  registry_id     = "${var.registry_id}"
  repostiory_name = "..."
}

[bflad]

In a future update of this data souce: instead of returning an error in this situation, we should likely just perform a latest image tag lookup instead, which matches the behavior of other tooling. The code and documentation should be updated to reflect this change. 👍

[bflad]

To prevent potential panics, we should prefer to skip direct * dereferences with d.Set(), which handles pointers automatically, or use the AWS Go SDK provided conversion functions (e.g. aws.StringValue(image.RegistryId)) here and below

Suggested change

	if err = d.Set("registry_id", *image.RegistryId); err != nil {
	if err = d.Set("registry_id", image.RegistryId); err != nil {

[bflad]

This can be simplified with the AWS Go SDK provided conversion function, aws.StringValueSlice()

Suggested change

	if err := d.Set("image_tags", tags); err != nil {
	if err := d.Set("image_tags", aws.StringValueSlice(image.ImageTags)); err != nil {

[bflad]

This has been released in version 2.11.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!