Amazon ECR

---

1 - Présentation

Amazon ECR (Elastic Container Registry) est un registre Docker entièrement managé pour stocker, gérer et déployer des images de conteneurs.

---

2 - Création et configuration

2.1 Créer un repository

# Créer un repository privé
aws ecr create-repository \
    --repository-name mon-app \
    --image-scanning-configuration scanOnPush=true \
    --encryption-configuration encryptionType=AES256 \
    --tags Key=Project,Value=MonProjet

# Créer avec immutabilité des tags
aws ecr create-repository \
    --repository-name mon-app-immutable \
    --image-tag-mutability IMMUTABLE

2.2 Via CloudFormation

AWSTemplateFormatVersion: '2010-09-09'

Resources:
  ECRRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: mon-application
      ImageTagMutability: MUTABLE
      ImageScanningConfiguration:
        ScanOnPush: true
      EncryptionConfiguration:
        EncryptionType: AES256
      RepositoryPolicyText:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowPush
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:role/CodeBuildRole
            Action:
              - ecr:GetDownloadUrlForLayer
              - ecr:BatchGetImage
              - ecr:BatchCheckLayerAvailability
              - ecr:PutImage
              - ecr:InitiateLayerUpload
              - ecr:UploadLayerPart
              - ecr:CompleteLayerUpload
      LifecyclePolicy:
        LifecyclePolicyText: |
          {
            "rules": [
              {
                "rulePriority": 1,
                "description": "Keep last 10 images",
                "selection": {
                  "tagStatus": "any",
                  "countType": "imageCountMoreThan",
                  "countNumber": 10
                },
                "action": {
                  "type": "expire"
                }
              }
            ]
          }
      Tags:
        - Key: Environment
          Value: Production

Outputs:
  RepositoryUri:
    Value: !GetAtt ECRRepository.RepositoryUri

---

3 - Push et Pull d'images

3.1 Authentification

# Login Docker vers ECR
aws ecr get-login-password --region eu-west-1 | \
  docker login --username AWS --password-stdin 123456789.dkr.ecr.eu-west-1.amazonaws.com

# Pour les scripts CI/CD
export ECR_REGISTRY=123456789.dkr.ecr.eu-west-1.amazonaws.com
aws ecr get-login-password --region eu-west-1 | docker login --username AWS --password-stdin $ECR_REGISTRY

3.2 Push d'une image

# Build l'image
docker build -t mon-app:latest .

# Tag pour ECR
docker tag mon-app:latest 123456789.dkr.ecr.eu-west-1.amazonaws.com/mon-app:latest
docker tag mon-app:latest 123456789.dkr.ecr.eu-west-1.amazonaws.com/mon-app:v1.0.0

# Push
docker push 123456789.dkr.ecr.eu-west-1.amazonaws.com/mon-app:latest
docker push 123456789.dkr.ecr.eu-west-1.amazonaws.com/mon-app:v1.0.0

3.3 Pull d'une image

# Pull une image
docker pull 123456789.dkr.ecr.eu-west-1.amazonaws.com/mon-app:v1.0.0

# Lister les images
aws ecr describe-images \
    --repository-name mon-app \
    --query 'imageDetails[*].[imageTags,imagePushedAt,imageSizeInBytes]'

---

4 - Scan de vulnérabilités

4.1 Types de scan

Type	Description
Basic	Scan basique (CVE)
Enhanced	Scan avec Amazon Inspector

4.2 Configuration du scan

# Activer le scan au push
aws ecr put-image-scanning-configuration \
    --repository-name mon-app \
    --image-scanning-configuration scanOnPush=true

# Scanner manuellement une image
aws ecr start-image-scan \
    --repository-name mon-app \
    --image-id imageTag=latest

# Voir les résultats du scan
aws ecr describe-image-scan-findings \
    --repository-name mon-app \
    --image-id imageTag=latest

4.3 Intégration CI/CD

# buildspec.yml
phases:
  post_build:
    commands:
      - docker push $ECR_REPO:$IMAGE_TAG
      
      # Attendre le scan
      - |
        aws ecr wait image-scan-complete \
          --repository-name mon-app \
          --image-id imageTag=$IMAGE_TAG
      
      # Vérifier les vulnérabilités critiques
      - |
        CRITICAL=$(aws ecr describe-image-scan-findings \
          --repository-name mon-app \
          --image-id imageTag=$IMAGE_TAG \
          --query 'imageScanFindings.findingSeverityCounts.CRITICAL' \
          --output text)
        if [ "$CRITICAL" != "None" ] && [ "$CRITICAL" -gt 0 ]; then
          echo "Critical vulnerabilities found!"
          exit 1
        fi

---

5 - Lifecycle Policies

5.1 Exemples de policies

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Expire untagged images older than 14 days",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 14
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Keep only 5 dev images",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["dev-"],
        "countType": "imageCountMoreThan",
        "countNumber": 5
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 3,
      "description": "Keep last 20 release images",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["v", "release-"],
        "countType": "imageCountMoreThan",
        "countNumber": 20
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}

5.2 Appliquer une policy

aws ecr put-lifecycle-policy \
    --repository-name mon-app \
    --lifecycle-policy-text file://lifecycle-policy.json

# Tester une policy (dry-run)
aws ecr get-lifecycle-policy-preview \
    --repository-name mon-app \
    --lifecycle-policy-text file://lifecycle-policy.json

---

6 - Cross-account et Cross-region

6.1 Repository policy pour cross-account

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountPull",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AUTRE_COMPTE_ID:root"
      },
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability"
      ]
    }
  ]
}

6.2 Réplication cross-region

ReplicationConfiguration:
  Type: AWS::ECR::ReplicationConfiguration
  Properties:
    ReplicationConfiguration:
      Rules:
        - Destinations:
            - Region: us-east-1
              RegistryId: !Ref AWS::AccountId
          RepositoryFilters:
            - Filter: prod-
              FilterType: PREFIX_MATCH

---

7 - ECR Public

# Créer un repository public
aws ecr-public create-repository \
    --repository-name mon-app-public \
    --region us-east-1

# Login au registre public
aws ecr-public get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin public.ecr.aws

# Push vers public
docker tag mon-app:latest public.ecr.aws/x1y2z3/mon-app:latest
docker push public.ecr.aws/x1y2z3/mon-app:latest

---

8 - Pull Through Cache

Cache des images depuis registres publics (Docker Hub, etc.).

# Créer une règle de cache
aws ecr create-pull-through-cache-rule \
    --ecr-repository-prefix docker-hub \
    --upstream-registry-url registry-1.docker.io

# Utiliser l'image cachée
docker pull 123456789.dkr.ecr.eu-west-1.amazonaws.com/docker-hub/library/nginx:latest

---

Résumé

Dans ce chapitre, nous avons appris :

• La création de repositories ECR
• Le push et pull d'images
• Le scan de vulnérabilités
• Les lifecycle policies pour le nettoyage
• La réplication cross-region et cross-account
• ECR Public et Pull Through Cache

---

Prochaine étape

Dans le prochain chapitre, nous verrons CloudWatch et X-Ray pour le monitoring.

→ Chapitre suivant : CloudWatch et X-Ray

---

← Retour à la table des matières