Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
uniqueImageName = docker.buildAndPushImage(imageName, build, repositoryUrl, logResource, async () => {
// Construct Docker registry auth data by getting the short-lived authorizationToken from ECR, and
// extracting the username/password pair after base64-decoding the token.
//
// See: http://docs.aws.amazon.com/cli/latest/reference/ecr/get-authorization-token.html
if (!registryId) {
throw new Error("Expected registry ID to be defined during push");
}
const credentials = await aws.ecr.getCredentials({ registryId: registryId });
const decodedCredentials = Buffer.from(credentials.authorizationToken, "base64").toString();
const [username, password] = decodedCredentials.split(":");
if (!password || !username) {
throw new Error("Invalid credentials");
}
return {
registry: credentials.proxyEndpoint,
username: username,
password: password,
};
});
imageDigest = docker.buildAndPushImage(imageName, build, repositoryUrl, logResource, async () => {
// Construct Docker registry auth data by getting the short-lived authorizationToken from ECR, and
// extracting the username/password pair after base64-decoding the token.
//
// See: http://docs.aws.amazon.com/cli/latest/reference/ecr/get-authorization-token.html
if (!registryId) {
throw new RunError("Expected registry ID to be defined during push");
}
const credentials = await aws.ecr.getCredentials({ registryId: registryId });
const decodedCredentials = Buffer.from(credentials.authorizationToken, "base64").toString();
const [username, password] = decodedCredentials.split(":");
if (!password || !username) {
throw new RunError("Invalid credentials");
}
return {
registry: credentials.proxyEndpoint,
username: username,
password: password,
};
});
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";
export class LifecyclePolicy extends aws.ecr.LifecyclePolicy {
/**
* Creates a new [LifecyclePolicy] for the given [repository]. If [args] is not provided, then
* [getDefaultLifecyclePolicyArgs] will be used to set the default policy for this repo.
*/
constructor(name: string, repository: aws.ecr.Repository, args?: LifecyclePolicyArgs, opts?: pulumi.ComponentResourceOptions) {
super(name, {
policy: convertToJSON(args || LifecyclePolicy.defaultLifecyclePolicyArgs()),
repository: repository.name,
}, opts);
}
/**
* Creates a default lifecycle policy such that at most a single untagged image is retained. All
* tagged layers and images will never expire.
*/
public static defaultLifecyclePolicyArgs(): LifecyclePolicyArgs {
// We tag all cached build layers as well as the final image, so those images will never expire.
const lifecyclePolicyDocument = {
rules: [{
rulePriority: 10,
description: "remove untagged images",
selection: {
tagStatus: "untagged",
countType: "imageCountMoreThan",
countNumber: 1,
},
action: {
type: "expire",
},
}],
};
const lifecyclePolicy = new aws.ecr.LifecyclePolicy(imageName.toLowerCase(), {
policy: JSON.stringify(lifecyclePolicyDocument),
repository: repository.name,
}, opts);
}
return repository;
}
const internetGateway = new aws.ec2.InternetGateway("myinternetgateway", {
vpcId: vpc.id,
});
const publicRouteTable = new aws.ec2.RouteTable("myroutetable", {
routes: [
{
cidrBlock: "0.0.0.0/0",
gatewayId: internetGateway.id,
},
],
vpcId: vpc.id,
});
// ECR
const repository = new aws.ecr.Repository("myrepository");
const repositoryPolicy = new aws.ecr.RepositoryPolicy("myrepositorypolicy", {
repository: repository.id,
policy: JSON.stringify({
Version: "2012-10-17",
Statement: [{
Sid: "new policy",
Effect: "Allow",
Principal: "*",
Action: [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability",
"ecr:PutImage",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
export const createDockerImages = async (environment: Environment) => {
const apiRepoName = `gauzy/api-${environment.toLowerCase()}`;
const repositoryApi = new aws.ecr.Repository(apiRepoName, {
name: apiRepoName
});
const webappRepoName = `gauzy/webapp-${environment.toLowerCase()}`;
const repositoryWebapp = new aws.ecr.Repository(webappRepoName, {
name: webappRepoName
});
let apiImage;
// Build and publish a Docker image to a private ECR registry for API.
if (environment !== Environment.Prod) {
apiImage = awsx.ecs.Image.fromDockerBuild(repositoryApi, {
context: config.dockerContextPath,
dockerfile: config.dockerAPIFile
function getOrCreateRepository(imageName: string): aws.ecr.Repository {
let repository: aws.ecr.Repository | undefined = repositories.get(imageName);
if (!repository) {
repository = new aws.ecr.Repository(imageName.toLowerCase());
repositories.set(imageName, repository);
}
return repository;
}
public static initialize(parent: pulumi.Resource, name: string, args: RepositoryArgs) {
const lowerCaseName = name.toLowerCase();
const repository = args.repository || new aws.ecr.Repository(lowerCaseName, args, { parent });
const lifecyclePolicy = new LifecyclePolicy(lowerCaseName, repository, args.lifeCyclePolicyArgs, { parent });
return {
repository,
lifecyclePolicy,
};
}