AWS ECR Pull-Through Cache with Pulumi

This example lives in the pulumi/examples repository. Check out just this directory to use it:

$ git clone --filter=blob:none --sparse https://github.com/pulumi/examples pulumi-examples
$ git -C pulumi-examples sparse-checkout set aws-ts-ecr-cache
$ cd pulumi-examples/aws-ts-ecr-cache

This Pulumi project creates AWS Elastic Container Registry (ECR) repositories with pull-through cache rules for Docker Hub, GitHub Container Registry, and GitLab Container Registry. It also sets up AWS Secrets Manager secrets to store credentials for Docker Hub, GitHub, and GitLab.

Prerequisites#

• Pulumi CLI
• Node.js
• Yarn
• AWS account and credentials configured

Project Structure#

• index.ts: The main Pulumi program that defines the infrastructure.
• Pulumi.yaml: The Pulumi project configuration file.
• tsconfig.json: TypeScript configuration file.
• package.json: Node.js project configuration file.
• .gitignore: Git ignore file.

Setup#

1. Install dependencies:

   yarn install

2. Configure Pulumi stack:

   pulumi config set aws:region <your-aws-region>

   Docker Hub#

   Note: To get your Docker Hub access token, log in to Docker Hub, navigate to Account Settings, and create a new access token.

   pulumi config set dockerHubUsername <your-docker-hub-username>
   pulumi config set --secret dockerHubAccessToken <your-docker-hub-access-token>

   GitHub#

   Note: To get your GitHub access token, log in to GitHub, navigate to Developer settings, and create a new personal access token with the read:packages scope.

   pulumi config set gitHubUsername <your-github-username>
   pulumi config set --secret gitHubAccessToken <your-github-access-token>

   GitLab#

   Note: To get your GitLab access token, log in to GitLab, navigate to Access Tokens, and create a new personal access token with the read_registry scope.

   pulumi config set gitLabUsername <your-gitlab-username>
   pulumi config set --secret gitLabAccessToken <your-gitlab-access-token>

3. Deploy the stack:

   pulumi up

Resources Created#

• ECR Repositories:

  • pullThroughCacheECR: ECR repository for pull-through cache.

• Pull-Through Cache Rules:

  • dockerHubCacheRule: Pull-through cache rule for Docker Hub (if dockerHubUsername is set).
  • githubCacheRule: Pull-through cache rule for GitHub Container Registry (if gitHubUsername is set).
  • gitLabCacheRule: Pull-through cache rule for GitLab Container Registry (if gitLabUsername is set).

• Secrets Manager Secrets:

  • ecrPullThroughCacheDockerHubSecret: Secret for Docker Hub credentials (if dockerHubUsername is set).
  • ecrPullThroughCacheGitHubSecret: Secret for GitHub credentials (if gitHubUsername is set).
  • ecrPullThroughCacheGitLabSecret: Secret for GitLab credentials (if gitLabUsername is set).

Outputs#

• pullThroughCacheECRRepositoryUrl: URL of the ECR repository.
• ecrRepositoryPrefixes: Prefixes for the ECR repositories.

Cleanup#

To remove all resources created by this project:

pulumi destroy