In a cloud computing and microservice world, infrastructure resources must be involved properly and consistently. Terraform, an open source IaC tool widely used for provisioning and managing cloud resources across many cloud service providers such as AWS, Microsoft Azure, Google Cloud Platform and off-premises environments, has become the de-facto standard for infrastructure definition. Among the workable services of AWS is Amazon Elastic Container Registry, a well-managed Docker container registry that gives the chance to store, manage, and deploy images.
Amazon Elastic Container Registry is a fully managed Docker container offering provided by Amazon Web Services. Repositories of ECR may be differentiating for the libraries, each of which contains multiple Docker Images, designated by different tags, versions and configurations. Terraform replies to the difficulty of creating and handling ECR repositories by providing a repeatable approach to IT architecture preservation. In Terraform, you may define your desired state of an ECR repository and other associated resources in a software configuration file. Terraform will consequently handle the creation, updating, and maintenance procedures for your infrastructure.
What Amazon ECR and Terraform Represent
Amazon ECR is a fully managed Docker container registry offered by AWS. It provides private and public repositories for storing images, with tag-based versioning and lifecycle controls.
Terraform is an open-source resource infrastructure tool manufactured by HashiCorp. It provides the independence of its declaration and configuration to developers and operations teams to define, provision, and manage cloud infrastructure resources across multiple cloud providers and off-premises environments in a consistent manner.
The basic structure of terraform is based on a human-friendly language that is called HashiCorp Configuration Language or HCL which implies the desired state of infrastructure resources. These resources can include things like virtual machines, networks, databases, and container registries provided by big top cloud providers such as Amazon Web Services, Microsoft Azure, Google Cloud Platform, and the rest.
Creating an ECR Repository with Native Terraform
A minimal configuration to get started with the native AWS provider is shown in the Terraform Registry documentation.
hcl
resource "aws_ecr_repository" "example" {
name = "my-ecr-repository"
}
The resource awsecrrepository manages an ECR Repository resource. A minimal configuration requires the name argument, and you can customize the repository name and other settings as needed.
A practical step-by-step guide for creation is:
- Install Terraform on your machine. You can download by referring to Terraform Install.
- Create a new Terraform configuration file, let's call it main.tf. In this file, you need to define the AWS provider and specify your AWS credentials.
- Define the awsecrrepository resource with name and optional settings.
- From here on, you will be able to push Docker images to this repository or performing other operations as required.
The common workflow commands are:
bash
terraform init
Open your terminal or command prompt, navigate to the directory containing your main.tf file, and run the following command to initialize Terraform.
bash
terraform plan
Before applying the configuration, you can review the execution plan.
bash
terraform apply
This command will prompt you to confirm the changes. Type yes to proceed. Terraform will create the ECR repository according to your configuration.
Verification is done via the AWS console. Deletion is handled via Terraform.
bash
terraform destroy
You can delete the AWS ECR once it's not required via the following command in the cli.
This is a basic example but you can customize this terraform code according to your specific needs. For instance: you can set repository policies and lifecycle polices or even configure other advanced options.
Working with the Terraform AWS Modules ECR Module
The terraform-aws-modules/ecr/aws module creates Amazon ECR resources with a flexible interface for managing ECR resources in AWS.
The module is highly customizable through many input variables. This guide provides essential instructions for setting up and using the terraform-aws-ecr module to manage Amazon Elastic Container Registry resources. For more advanced features like pull-through cache configuration or replication settings, see Advanced Features.
Before using the terraform-aws-ecr module, ensure you have the prerequisites in place. To use the module in your Terraform configuration, add the following block.
A comparison of native resource vs module usage is shown below.
| Aspect | Native awsecrrepository | terraform-aws-modules/ecr/aws |
| Native resource | Single resource declaration | Module wraps repository, policy, lifecycle |
| Configuration style | Direct arguments | Input variables with sensible defaults |
| Reuse | Manual copy-paste | Versioned module source |
| Typical use | Simple repositories | Private, public, registry policy setups |
Private Repository with Lifecycle Policy
This example shows how to create a private ECR repository with a lifecycle policy and access control.
hcl
module "ecr" {
source = "terraform-aws-modules/ecr/aws"
repository_name = "private-example"
repository_read_write_access_arns = ["arn:aws:iam::012345678901:role/terraform"]
repository_lifecycle_policy = jsonencode({
rules = [
{
rulePriority = 1,
description = "Keep last 30 images",
selection = {
tagStatus = "tagged",
tagPrefixList = ["v"],
countType = "imageCountMoreThan",
countNumber = 30
},
action = {
type = "expire"
}
}
]
})
tags = {
Terraform = "true"
Environment = "dev"
}
}
The module allows definition of repositoryreadwriteaccessarns and repositorylifecyclepolicy via jsonencode.
Public Repository Configuration
For a public repository, use the following configuration.
hcl
module "public_ecr" {
source = "terraform-aws-modules/ecr/aws"
repository_name = "public-example"
repository_type = "public"
repository_read_write_access_arns = ["arn:aws:iam::012345678901:role/terraform"]
public_repository_catalog_data = {
description = "Docker container for some things"
about_text = file("${path.module}/files/ABOUT.md")
usage_text = file("${path.module}/files/USAGE.md")
operating_systems = ["Linux"]
architectures = ["x86"]
logo_image_blob = filebase64("${path.module}/files/clowd.png")
}
tags = {
Terraform = "true"
Environment = "dev"
}
}
Registry Policy Example
The module can be used to manage registry policies without creating a repository.
hcl
module "ecr_registry" {
source = "terraform-aws-modules/ecr/aws"
repository_name = "registry-example"
create_repository = false
create_registry_policy = true
registry_policy = jsonencode({
Version = "2012-10-17",
Statement = [
{
Sid = "testpolicy",
Effect = "Allow",
Principal = {
"AWS" :
}
}
]
})
}
This diagram illustrates the configuration flow from Terraform variables to AWS ECR resources.
Operational Workflow with Terraform
Using Terraform to create an Amazon Elastic Container Registry repository offers several advantages.
Infrastructure as Code: You will be using Terraform to configure the necessary things that you are aiming to use, which are, ECR repositories among others, as the code. This will provide the consistency, reproducibility, and version control mechanisms, in which your infrastructure setup will be provided.
Automated Provisioning: Terraform being used, you can have the ability of content population and management of ECR repositories. Thus, a reduction in human interventions is achieved, and the human error reluctance is established.
Declarative Configuration: Terraform uses a declarative syntax for specifying resources by the means of its configuration file – the terraform.tf.
The step sequence for a typical deployment is:
- Install Terraform
- Configure AWS Provider in main.tf with credentials
- Define repository resource or module block
- Run terraform init
- Run terraform plan to review execution plan
- Run terraform apply to create the ECR repository according to your configuration
- Verify the deployment via the AWS console
- Delete the deployment when no longer required
Module Input Surface
The module is highly customizable through many input variables.
| Input | Purpose |
| repositoryname | Name of the ECR repository |
| repositorytype | private or public |
| repositoryreadwriteaccessarns | ARNs allowed read-write access |
| repositorylifecyclepolicy | JSON encoded lifecycle rules |
| createrepository | Toggle repository creation |
| createregistrypolicy | Toggle registry policy creation |
| registrypolicy | JSON encoded registry policy |
| tags | Common tags applied to resources |
Conclusion
Terraform provides a durable method for ECR repository creation and ongoing management. The native awsecrrepository resource satisfies minimal requirements with direct control over name and arguments, while the terraform-aws-modules/ecr/aws module adds structured defaults for lifecycle policies, access control, public catalog data, and registry policies. Combining declarative HCL definitions with versioned modules enables teams to treat container registries as code, with reproducible provisioning, automated updates, and auditable change plans. As ECR usage scales across environments, module-based patterns reduce duplication and enforce policy consistency without sacrificing the ability to customize repository behavior per workload.