Managing Amazon ECR Repositories with Terraform

Infrastructure as code has become the de-facto standard for provisioning and managing cloud resources across Amazon Web Services, Microsoft Azure, Google Cloud Platform, and on-premises environments. Terraform, an open source infrastructure resource tool manufactured by HashiCorp, provides declarative configuration using HashiCorp Configuration Language, HCL, to define the desired state of infrastructure resources. Those resources can include virtual machines, networks, databases, and container registries provided by major cloud providers.

In a cloud computing and microservice world, involvement of infrastructure resources must be concentrated and reproducible. Amazon Elastic Container Registry, ECR, is a well-managed Docker container registry that gives the chance to images to store, manage, and deploy. Terraform replies to the difficulty of creating and handling ECR repositories by providing an approach to IT architecture preservation. With Terraform, desired state of an ECR repository and other associated resources can be defined in a software configuration file. Terraform will consequently handle the creation, updating, and maintenance procedures for infrastructure.

What ECR Is and Why Terraform Matters

Amazon ECR is a fully managed Docker container offering provided by Amazon Web Services, a cloud computing subsidiary of Amazon. ECR is a service offered by AWS that allows developers to store, manage, and deploy Docker container images and Open Container Initiative, OCI, images. It integrates seamlessly with Amazon ECS, EKS, and other AWS services, enabling streamlined containerized application development and deployment.

ECR provides features like image versioning, access control, and automated scanning for vulnerabilities. Each ECR account has its own private registry, where you can create one or more repositories to store Docker images, OCI images, and compatible artifacts. Clients must authenticate to an Amazon ECR private registry as an AWS user before pushing or pulling images.

Repositories of ECR may be differentiating for libraries, each of which contains multiple Docker Images, designated by different tags which represent versions and configurations. The registry model keeps image storage separate from compute, with ECR using S3 as the underlying storage layer, which provides durability, availability, and lifecycle management for the images.

ECR also supports Cross-Region and Cross-Account Replication to replicate images where needed easily. Cost is pay-as-you-go, meaning you only pay for the amount of storage used and the data transferred without upfront costs.

Frequently asked clarifications help set expectations:

Amazon Elastic Container Registry is a managed container image registry service provided by AWS, used to store, manage, and deploy Docker container images.
ECR is used to store, manage, and deploy Docker container images in AWS. It integrates with services like ECS, EKS, and CodeBuild, allowing secure, scalable image storage without managing your own registry.
ECR uses S3 as the underlying storage layer.

Terraform Fundamentals for AWS

Terraform is an open-source resource infrastructure tool manufactured by HashiCorp. It provides the independence of its declaration and configuration to developers and operations teams to define, provision, and manage cloud infrastructure resources across multiple cloud providers and off-premises environments in a consistent manner.

The basic structure of Terraform is based on a human-friendly language that is called HashiCorp Configuration Language or HCL which implies the desired state of infrastructure resources. These resources can include things like virtual machines, networks, databases, and container registries provided by big top cloud providers such as Amazon Web Services, Microsoft Azure, Google Cloud Platform, and the rest.

OpenTofu is an open-source version of Terraform that expands on Terraform’s existing concepts and offerings. It is a viable alternative to HashiCorp’s Terraform, being forked from Terraform version 1.5.6.

Creating an ECR Repository with Terraform: Practical Steps

Create ECR repository in AWS using Terraform follows a repeatable sequence.

Step 1: Install Terraform

If you haven't already, install Terraform on your machine. You can download by referring to Terraform Install. Make sure you have Terraform installed on your machine.

Step 2: Configure AWS Provider

Create a new Terraform configuration file, let's call it main.tf. In this file, you need to define the AWS provider and specify your AWS credentials.

Once you have Terraform installed, it’s time to add some configuration files. Create a new Terraform configuration file, e.g., main.tf.

Step 3: Create an ECR repository

The steps to creating an ECR repository with Terraform are as follows:

Install Terraform
Configure Terraform AWS provider
Create an ECR repository
Run terraform init
Run terraform plan
Apply your configuration
Verify the deployment in the AWS console
Run terraform destroy

Step 4: Initialize

Run terraform init to prepare the working directory.

Step 5: Plan

This allows you to review what will be created before applying it. Run terraform plan.

Step 6: Apply

If the terraform plan output looks good, run terraform apply to create the ECR repository in your AWS account.

Step 7: Verify

Step 8: Destroy

When you’re finished with the ECR repository and want to remove it, run terraform destroy. This will destroy the resources in your AWS account.

Note: Be cautious, as this cannot be undone by default.

Using the terraform-aws-ecr Module

This guide provides essential instructions for setting up and using the terraform-aws-ecr module to manage Amazon Elastic Container Registry resources. For more advanced features like pull-through cache configuration or replication settings, see Advanced Features.

Before using the terraform-aws-ecr module, ensure you have the prerequisites in place.

To use the module in your Terraform configuration, add the following block:

module "ecr" { source = "terraform-aws-modules/ecr/aws" ... }

The terraform-aws-ecr module provides a flexible interface for managing ECR resources in AWS.

The module is highly customizable through many input variables.

Private Repository with Lifecycle Policy and Access Control

This example shows how to create a private ECR repository with a lifecycle policy and access control.

A private repository can be created with a lifecycle policy attached to expire old or untagged images and keep storage costs in check.

resource "aws_ecr_repository" "example" { name = "my-private-repo" image_tag_mutability = "MUTABLE" }

Lifecycle policy uses awsecrlifecycle_policy with a JSON policy using camelCase keys.

resource "aws_ecr_lifecycle_policy" "example" { repository = aws_ecr_repository.example.name policy = jsonencode({ rules = [ { rulePriority = 1 description = "Expire old untagged images" selection = { tagStatus = "untagged" countType = "imageCountMoreThan" countNumber = 10 } action = { type = "expire" } } ] }) }

Public Repository Configuration

For a public repository, use the following configuration:

Public repositories differ in access settings and do not require private authentication.

The configuration flow from Terraform variables to AWS ECR resources is illustrated in module documentation.

Managing Existing Repositories and Multiple Repositories

Bring an existing repository under Terraform management with a top-level import block. Requires Terraform 1.5 or later, and the id is the repository name.

import { to = aws_ecr_repository.existing id = "existing-repo-name" }

For multiple repositories that share configuration, use a public module like terraform-aws-modules/ecr/aws or cloudposse/ecr/aws, or wrap the resource in your own module.

Lifecycle Policies and Cost Management

With AWS ECR, you can define lifecycle policies to manage the lifecycle of your container images, such as automatically deleting old or unused images, which helps manage costs and storage.

To do this using Terraform, you’ll use the awsecrlifecycle_policy resource block.

The policy is expressed as JSON with camelCase keys. Rules can target untagged images, images older than a certain age, or images beyond a count threshold. This keeps storage costs in check and aligns with pay-as-you-go pricing.

Common Configuration Patterns

The following table summarizes typical ECR repository configurations managed via Terraform.

Steps involved in a standard deployment workflow are listed below.

Install Terraform
Configure Terraform AWS provider
Create an ECR repository
Run terraform init
Run terraform plan
Apply your configuration
Verify the deployment in the AWS console
Run terraform destroy

Automation and Operations

Automate your infrastructure provisioning, build more complex workflows based on Terraform using policy as code, programmatic configuration, context sharing, drift detection, resource visualization, and many more.

Terraform’s plan step allows review before apply. Destroy provides removal of resources, but requires caution because the operation cannot be undone by default.

Conclusion

Terraform provides a repeatable, declarative method to provision Amazon ECR repositories and associated policies. Defining desired state in HCL allows creation, updating, and maintenance of ECR resources without manual console operations. The terraform-aws-ecr module adds flexibility for private repositories, public repositories, lifecycle policies, and access control. Importing existing repositories and reusing modules supports teams that manage many repositories with shared configuration. Lifecycle policies using awsecrlifecycle_policy keep storage costs predictable, and integration with ECS, EKS, and CodeBuild aligns image storage with application delivery pipelines. As container workloads grow, treating ECR as code is the operational baseline for reliable, auditable registry management.