Toggle image scanning on ECR (#36)

* Add scan_images_on_push variable * Update Readme * Fix formatting * Set AWS provider minimum required version to v2.34.0 * Update documentation
cloudposse · Nov 6, 2019 · 5a86dce · 5a86dce
1 parent 0938bd2
commit 5a86dce
Show file tree

Hide file tree

Showing 5 changed files with 26 additions and 13 deletions.
diff --git a/README.md b/README.md
@@ -100,6 +100,7 @@ Available targets:
 | namespace | Namespace (e.g. `eg` or `cp`) | string | `` | no |
 | principals_full_access | Principal ARNs to provide with full access to the ECR | list(string) | `<list>` | no |
 | principals_readonly_access | Principal ARNs to provide with readonly access to the ECR | list(string) | `<list>` | no |
+| scan_images_on_push | Indicates whether images are scanned after being pushed to the repository (true) or not (false) | bool | `false` | no |
 | stage | Stage (e.g. `prod`, `dev`, `staging`) | string | `` | no |
 | tags | Additional tags (e.g. `map('BusinessUnit','XYZ')`) | map(string) | `<map>` | no |
 | use_fullname | Set 'true' to use `namespace-stage-name` for ecr repository name, else `name` | bool | `true` | no |
@@ -252,15 +253,15 @@ Check out [our other projects][github], [follow us on twitter][twitter], [apply
 |---|---|---|---|---|
 
   [goruha_homepage]: https://github.com/goruha
-  [goruha_avatar]: https://github.com/goruha.png?size=150
+  [goruha_avatar]: https://img.cloudposse.com/150x150/https://github.com/goruha.png
   [aknysh_homepage]: https://github.com/aknysh
-  [aknysh_avatar]: https://github.com/aknysh.png?size=150
+  [aknysh_avatar]: https://img.cloudposse.com/150x150/https://github.com/aknysh.png
   [s2504s_homepage]: https://github.com/s2504s
-  [s2504s_avatar]: https://github.com/s2504s.png?size=150
+  [s2504s_avatar]: https://img.cloudposse.com/150x150/https://github.com/s2504s.png
   [ivan-pinatti_homepage]: https://github.com/ivan-pinatti
-  [ivan-pinatti_avatar]: https://github.com/ivan-pinatti.png?size=150
+  [ivan-pinatti_avatar]: https://img.cloudposse.com/150x150/https://github.com/ivan-pinatti.png
   [osterman_homepage]: https://github.com/osterman
-  [osterman_avatar]: https://github.com/osterman.png?size=150
+  [osterman_avatar]: https://img.cloudposse.com/150x150/https://github.com/osterman.png
 
 
 

diff --git a/docs/terraform.md b/docs/terraform.md
@@ -10,6 +10,7 @@
 | namespace | Namespace (e.g. `eg` or `cp`) | string | `` | no |
 | principals_full_access | Principal ARNs to provide with full access to the ECR | list(string) | `<list>` | no |
 | principals_readonly_access | Principal ARNs to provide with readonly access to the ECR | list(string) | `<list>` | no |
+| scan_images_on_push | Indicates whether images are scanned after being pushed to the repository (true) or not (false) | bool | `false` | no |
 | stage | Stage (e.g. `prod`, `dev`, `staging`) | string | `` | no |
 | tags | Additional tags (e.g. `map('BusinessUnit','XYZ')`) | map(string) | `<map>` | no |
 | use_fullname | Set 'true' to use `namespace-stage-name` for ecr repository name, else `name` | bool | `true` | no |

diff --git a/main.tf b/main.tf
@@ -18,7 +18,12 @@ module "label" {
 resource "aws_ecr_repository" "default" {
   count = var.enabled ? 1 : 0
   name  = var.use_fullname ? module.label.id : module.label.name
-  tags  = module.label.tags
+
+  image_scanning_configuration {
+    scan_on_push = var.scan_images_on_push
+  }
+
+  tags = module.label.tags
 }
 
 resource "aws_ecr_lifecycle_policy" "default" {
@@ -65,7 +70,7 @@ data "aws_iam_policy_document" "resource_readonly_access" {
   count = var.enabled ? 1 : 0
 
   statement {
-    sid = "ReadonlyAccess"
+    sid    = "ReadonlyAccess"
     effect = "Allow"
 
     principals {
@@ -91,7 +96,7 @@ data "aws_iam_policy_document" "resource_full_access" {
   count = var.enabled ? 1 : 0
 
   statement {
-    sid = "FullAccess"
+    sid    = "FullAccess"
     effect = "Allow"
 
     principals {
@@ -118,13 +123,13 @@ data "aws_iam_policy_document" "resource_full_access" {
 }
 
 data "aws_iam_policy_document" "resource" {
-  count = var.enabled ? 1 : 0
-  source_json = local.principals_readonly_access_non_empty ? join("", data.aws_iam_policy_document.resource_readonly_access.*.json) : join("", data.aws_iam_policy_document.empty.*.json)
+  count         = var.enabled ? 1 : 0
+  source_json   = local.principals_readonly_access_non_empty ? join("", data.aws_iam_policy_document.resource_readonly_access.*.json) : join("", data.aws_iam_policy_document.empty.*.json)
   override_json = local.principals_full_access_non_empty ? join("", data.aws_iam_policy_document.resource_full_access.*.json) : join("", data.aws_iam_policy_document.empty.*.json)
 }
 
 resource "aws_ecr_repository_policy" "default" {
-  count = local.ecr_need_policy && var.enabled ? 1 : 0
+  count      = local.ecr_need_policy && var.enabled ? 1 : 0
   repository = join("", aws_ecr_repository.default.*.name)
-  policy = join("", data.aws_iam_policy_document.resource.*.json)
+  policy     = join("", data.aws_iam_policy_document.resource.*.json)
 }
diff --git a/variables.tf b/variables.tf
@@ -57,6 +57,12 @@ variable "principals_readonly_access" {
   default     = []
 }
 
+variable "scan_images_on_push" {
+  type        = bool
+  description = "Indicates whether images are scanned after being pushed to the repository (true) or not (false)"
+  default     = false
+}
+
 variable "max_image_count" {
   description = "How many Docker Image versions AWS ECR will store"
   default     = 500

diff --git a/versions.tf b/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_version = "~> 0.12.0"
 
   required_providers {
-    aws      = "~> 2.0"
+    aws      = "~> 2.34"
     template = "~> 2.0"
     local    = "~> 1.2"
     null     = "~> 2.0"