aws-cloudformation / aws-cloudformation-resource-providers-ecr Goto Github PK

Question: does AWS::ECR::Repository LifecyclePolicy support AWS::NoValue

How can I pass in a number to the Policy ? the values for "LifecyclePolicyText" is a String.
Using a "!Ref" also results in a string, which fails as it needs to be a number.

ECRImageRetentionNr:
    Description: >
      The number of ECR Images that should be retained in an ECR Repository.
      Default is 999 number of images.
    Type: Number
    Default: 999

Type: AWS::ECR::Repository
   LifecyclePolicy:
        LifecyclePolicyText: |
          {
              "rules": [
                {
                  "rulePriority": 1,
                  "description": "Rule 1",
                  "selection": {
                      "tagStatus": "any",
                      "countType": "imageCountMoreThan",
                      "countNumber": !Ref ECRImageRetention
                  },
                  "action": {
                    "type": "expire"
                  }
                }
              ]
            }

Name of the resource

AWS::ECR::Repository

Issue Description

To find the right CloudFormation Stack, where a AWS resource is defined/maintained aws:cloudformation:* built-in tags are needed. This is an important function in day-to-day business.

Expected Behavior

Resources with type AWS::ECR::Repository, which are managed as CloudFormations Stacks, should automatically receive the aws:cloudformation:* built-in tags / automatic default CFN AutoTags.

Furthermore those aws:cloudformation:* built-in tags must be handled by CloudFormation Drift-Detection correctly (hence, aws:cloudformation:* tags are not a drift)

Observed Behavior

When you have an AWS::ECR::Repository resource in your stack, it does not get the built-in tags assigned: aws:cloudformation:stack-name, aws:cloudformation:logical-id and aws:cloudformation:stack-id

Test Cases

Deploy a CloudFormation stack containing this resource named above (e.g. sample from AWS docs) and check the tags on the console. You can't see aws:cloudformation:* built-in tags.

I've re-tested it right now in eu-central-1 region. No tags aws:cloudformation:* are added to the ECS Service resource.

Other Details

In the area of AWS ECS/ECR Services the resource AWS::ECS::Cluster already receiving aws:cloudformation:* auto-tags.

Furthermore, there is already an open issue in cloudformation-coverage-roadmap repo aws-cloudformation/cloudformation-coverage-roadmap#1280 since 2022.

Cross posting here for tracking.

aws-cloudformation/cloudformation-coverage-roadmap#654

As of Jul 29, 2020 ECR now supports encryption of images using AWS KMS keys.
https://aws.amazon.com/about-aws/whats-new/2020/07/ecr-supports-encryption-images-aws-kms-keys/

Please add EncryptionConfiguration property to AWS::ECR::Repository resource type.

AWS::ECR::Repository
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repository.html

EncryptionConfiguration
https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_EncryptionConfiguration.html

Describe the feature

Add CFN properties to enable enhanced image scanning for ECR repositories

https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced.html

Use Case

I would like to enable enhanced image scanning through CDK. The alternative route right now is to create a CFN stack using custom resources that invoke the AWS SDK.

related: aws/aws-cdk#26536