Skip to main content
Type: rvn-aws-ecr / Latest version: 1.0.0

​
Readme

Creates a private Amazon ECR repository for container images with scan on push, image cleanup, optional KMS encryption, and cross-account access.

​
Overview

Use this module to keep container images in a private Amazon ECR repository for application services and CI pipelines. Images are scanned on push by default, and the repository can grant selected AWS principals pull or push access.

​
Use cases

​
Image cleanup

Cleanup is enabled by default. The policy expires untagged images after 14 days and keeps the newest 100 images (tagged or untagged), matching the policy used by ECS and EKS service repositories. Change the two counts to suit your rollback needs. Raw JSON lifecycle policies are available only through Advanced Terraform variables as lifecycle_policy; when set, that policy takes precedence over the built-in rules.

​
Repository access

Pull principal ARNs grant image pull access, while push principal ARNs grant pull and push access. Both lists are empty by default. For principals in the same account, IAM policies can grant access without adding a repository policy. Raw JSON repository policies are available only through Advanced Terraform variables as repository_policy; when set, that policy takes precedence over the principal lists.

​
Encryption

Repositories use AES-256 encryption with an AWS-owned key by default. Choose AWS KMS to use a customer-managed key; leaving KMS key ARN empty uses the AWS-managed aws/ecr key. Encryption type and KMS key ARN are immutable because changing either replaces the repository.

​
Configuration

​
Design decisions

The form defaults to mutable tags, scan on push, and image cleanup. The cleanup defaults preserve recent images while placing a time limit on untagged images. Encryption type and KMS key ARN cannot be changed after creation because ECR replaces the repository when these settings change. Force deletion is off by default.

​
Learn more

​
Inputs reference

All inputs for rvn-aws-ecr version 1.0.0. Use the name shown for each field as the input key in module config.

​
AWS account & region

​
string
required
AWS account.
  • Immutable after creation
​
string
required
Region.
  • Immutable after creation

​
Repository

​
string
required
Repository name. Use slashes to group repositories, such as team/api.
  • Default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
  • Immutable after creation
  • Pattern: ^(?:[a-z0-9]+(?:[._-][a-z0-9]+)*/)*[a-z0-9]+(?:[._-][a-z0-9]+)*$ — Lowercase letters, numbers, and . _ - / separators. Start and end with a letter or number.
  • Pattern: ^.{2,256}$ — 2-256 characters.
​
string
required
Image tag mutability. Immutable tags can’t be pushed again, so a tag always points at the same image.
  • Default: MUTABLE
  • Allowed values: MUTABLE (Mutable), IMMUTABLE (Immutable)
​
boolean
Scan images on push. Basic ECR vulnerability scan on every push. Turn off if another scanner covers it.
  • Default: true

​
Image cleanup

​
boolean
Clean up old images. Expires untagged images after a set period and limits how many images (tagged or untagged) are retained.
  • Default: true
​
number
required
Expire untagged images after (days).
  • Default: 14
  • Min: 1
  • Shown when: {"default_lifecycle_policy_enabled":true}
​
number
required
Images to keep. Older images are expired once the repository holds more than this, tagged or untagged. Keep it above the number of images you may roll back to.
  • Default: 100
  • Min: 1
  • Shown when: {"default_lifecycle_policy_enabled":true}

​
Repository access

​
string_array
Pull principal ARNs. Principals in this or other accounts that can pull images. Principals in this account can also be granted access through IAM policies alone.
  • Default: []
  • Pattern: ^arn:aws(-us-gov|-cn|-iso|-iso-b|-iso-e|-iso-f)?:iam::[0-9]{12}:(root|(role|user)/[!-~]*[A-Za-z0-9+=,.@_-])$ — Invalid IAM principal ARN. Use an account root, role, or user ARN with a 12-digit account ID.
​
string_array
Push principal ARNs. Principals that can push and pull images, such as a CI role in another account.
  • Default: []
  • Pattern: ^arn:aws(-us-gov|-cn|-iso|-iso-b|-iso-e|-iso-f)?:iam::[0-9]{12}:(root|(role|user)/[!-~]*[A-Za-z0-9+=,.@_-])$ — Invalid IAM principal ARN. Use an account root, role, or user ARN with a 12-digit account ID.

​
Encryption

​
string
required
Encryption.
  • Default: AES256
  • Allowed values: AES256 (AES-256 (AWS owned key)), KMS (AWS KMS)
  • Immutable after creation
​
string
KMS key ARN. Leave empty to use the AWS managed aws/ecr key.
  • Immutable after creation
  • Pattern: ^arn:aws(-us-gov|-cn|-iso|-iso-b|-iso-e|-iso-f)?:kms:[a-z0-9-]+:[0-9]{12}:key/[A-Za-z0-9-]+$ — Invalid KMS key ARN.
  • Shown when: {"encryption_type":"KMS"}

​
Misc

​
boolean
Force delete repository. Allow the repository to be deleted even when it contains images. Use with care.
  • Default: false
​
keyvalue
Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

​
Terraform settings

​
string
OpenTofu version override. Override the environment’s default version for this module
​
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
​
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
  • Default: true
​
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
  • Default: true
​
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
  • Default: {}
​
string
Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.