aws_ecr Resource
WARNING: This resource is deprecated. Please use one of the following resources instead.
aws_ecr_image
aws_ecr_images
aws_ecr_repository
aws_ecr_repositories
Use the aws_ecr
InSpec audit resource to test properties of a single AWS Elastic Container Registry.
Install
This resource is available in the Chef InSpec AWS resource pack.
For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.
Syntax
An aws_ecr
resource block declares the tests for a single AWS ECR by repository name.
describe aws_ecr(repository_name: aws_ecr_name) do
it { should exist }
its ('repository_name') { should eq aws_ecr_name }
end
Parameters
The ECR repository_name must be provided.
repository_name
(required)The name of the repository This can be passed either as a string or as an
repository_name: 'value'
key-value entry in a hash.
Properties
registry_id
- The AWS account ID associated with the registry.
repository_arn
- The Amazon Resource Name of the repository.
repository_name
- The name of the repository.
repository_uri
- The uri of the repository.
image_tags
- The tags associated with the image.
image_digest
- A sha256 hash of the image.
image_size_in_bytes
- The size of the image in bytes.
image_pushed_at
- The datetime as a string when the image was uploaded. ‘yyyy-mm-dd hh:mm:ss tz’.
image_uploaded_date
- The date as a string when the image was uploaded. ‘yyyy-mm-dd’.
Examples
Test that an ECR has the correct image properties.
describe aws_ecr(repository_name: aws_ecr_name).images do
its ('image_tags') { should include 'latest'}
its ('image_digest') { should eq 'sha256:6dce4a9c1635c4c9b6a2b645e6613fa0238182fe13929808ee2258370d0f3497'}
its ('image_size_in_bytes') { should eq 764234}
its ('image_uploaded_date') { should eq '2019-06-11'}
its ('image_pushed_at') { should eq '2019-06-11 15:08:29 +0100'}
end
Matchers
For a full list of available matchers, see our Universal Matchers page.This resource has the following special matchers.
exist
The control will pass if the describe returns at least one result.
Use should_not
to test the entity should not exist.
it { should exist }
it { should_not exist }
AWS Permissions
Your Principal will need the ECR:Client:DescribeRepositoriesResponse
and ECR:Client:DescribeImagesResponse
actions set to allow..
You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon ECR, and Actions, Resources, and Condition Keys for Identity And Access Management.