@jcoreio/aws-ecr-utils 1.3.1 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/ImageManifestSchema.d.mts +59 -0
- package/ImageManifestSchema.d.mts.map +1 -0
- package/ImageManifestSchema.d.ts +50 -49
- package/ImageManifestSchema.d.ts.map +1 -0
- package/ImageManifestSchema.js +2 -1
- package/ImageManifestSchema.js.map +1 -0
- package/ImageManifestSchema.mjs +2 -1
- package/ImageManifestSchema.mjs.map +1 -0
- package/checkECRImageAccess.d.mts +25 -0
- package/checkECRImageAccess.d.mts.map +1 -0
- package/checkECRImageAccess.d.ts +25 -17
- package/checkECRImageAccess.d.ts.map +1 -0
- package/checkECRImageAccess.js +65 -65
- package/checkECRImageAccess.js.map +1 -0
- package/checkECRImageAccess.mjs +22 -19
- package/checkECRImageAccess.mjs.map +1 -0
- package/checkECRRepositoryPolicy.d.mts +28 -0
- package/checkECRRepositoryPolicy.d.mts.map +1 -0
- package/checkECRRepositoryPolicy.d.ts +21 -12
- package/checkECRRepositoryPolicy.d.ts.map +1 -0
- package/checkECRRepositoryPolicy.js +27 -26
- package/checkECRRepositoryPolicy.js.map +1 -0
- package/checkECRRepositoryPolicy.mjs +11 -9
- package/checkECRRepositoryPolicy.mjs.map +1 -0
- package/copyECRImage.d.mts +17 -0
- package/copyECRImage.d.mts.map +1 -0
- package/copyECRImage.d.ts +17 -12
- package/copyECRImage.d.ts.map +1 -0
- package/copyECRImage.js +21 -20
- package/copyECRImage.js.map +1 -0
- package/copyECRImage.mjs +2 -1
- package/copyECRImage.mjs.map +1 -0
- package/ecrImageExists.d.mts +17 -0
- package/ecrImageExists.d.mts.map +1 -0
- package/ecrImageExists.d.ts +17 -8
- package/ecrImageExists.d.ts.map +1 -0
- package/ecrImageExists.js +17 -16
- package/ecrImageExists.js.map +1 -0
- package/ecrImageExists.mjs +6 -5
- package/ecrImageExists.mjs.map +1 -0
- package/formatECRImageUri.d.mts +12 -0
- package/formatECRImageUri.d.mts.map +1 -0
- package/formatECRImageUri.d.ts +12 -5
- package/formatECRImageUri.d.ts.map +1 -0
- package/formatECRImageUri.js +2 -1
- package/formatECRImageUri.js.map +1 -0
- package/formatECRImageUri.mjs +2 -1
- package/formatECRImageUri.mjs.map +1 -0
- package/formatECRRepositoryHostname.d.mts +10 -0
- package/formatECRRepositoryHostname.d.mts.map +1 -0
- package/formatECRRepositoryHostname.d.ts +10 -4
- package/formatECRRepositoryHostname.d.ts.map +1 -0
- package/formatECRRepositoryHostname.js +2 -1
- package/formatECRRepositoryHostname.js.map +1 -0
- package/formatECRRepositoryHostname.mjs +2 -1
- package/formatECRRepositoryHostname.mjs.map +1 -0
- package/index.d.mts +12 -0
- package/index.d.mts.map +1 -0
- package/index.d.ts +12 -11
- package/index.d.ts.map +1 -0
- package/index.js +2 -1
- package/index.js.map +1 -0
- package/index.mjs +2 -1
- package/index.mjs.map +1 -0
- package/loginToECR.d.mts +11 -0
- package/loginToECR.d.mts.map +1 -0
- package/loginToECR.d.ts +11 -7
- package/loginToECR.d.ts.map +1 -0
- package/loginToECR.js +96 -28
- package/loginToECR.js.map +1 -0
- package/loginToECR.mjs +46 -8
- package/loginToECR.mjs.map +1 -0
- package/package.json +17 -6
- package/parseECRImageUri.d.mts +7 -0
- package/parseECRImageUri.d.mts.map +1 -0
- package/parseECRImageUri.d.ts +7 -6
- package/parseECRImageUri.d.ts.map +1 -0
- package/parseECRImageUri.js +2 -1
- package/parseECRImageUri.js.map +1 -0
- package/parseECRImageUri.mjs +2 -1
- package/parseECRImageUri.mjs.map +1 -0
- package/parseECRRepositoryHostname.d.mts +6 -0
- package/parseECRRepositoryHostname.d.mts.map +1 -0
- package/parseECRRepositoryHostname.d.ts +6 -5
- package/parseECRRepositoryHostname.d.ts.map +1 -0
- package/parseECRRepositoryHostname.js +2 -1
- package/parseECRRepositoryHostname.js.map +1 -0
- package/parseECRRepositoryHostname.mjs +2 -1
- package/parseECRRepositoryHostname.mjs.map +1 -0
- package/src/ImageManifestSchema.ts +19 -0
- package/src/checkECRImageAccess.ts +193 -0
- package/src/checkECRRepositoryPolicy.ts +153 -0
- package/src/copyECRImage.ts +76 -0
- package/src/ecrImageExists.ts +48 -0
- package/src/formatECRImageUri.ts +19 -0
- package/src/formatECRRepositoryHostname.ts +11 -0
- package/src/index.ts +11 -0
- package/src/loginToECR.ts +96 -0
- package/src/parseECRImageUri.ts +13 -0
- package/src/parseECRRepositoryHostname.ts +12 -0
- package/src/tagECRImage.ts +57 -0
- package/src/upsertECRRepository.ts +40 -0
- package/tagECRImage.d.mts +16 -0
- package/tagECRImage.d.mts.map +1 -0
- package/tagECRImage.d.ts +13 -6
- package/tagECRImage.d.ts.map +1 -0
- package/tagECRImage.js +46 -45
- package/tagECRImage.js.map +1 -0
- package/tagECRImage.mjs +9 -9
- package/tagECRImage.mjs.map +1 -0
- package/upsertECRRepository.d.mts +11 -0
- package/upsertECRRepository.d.mts.map +1 -0
- package/upsertECRRepository.d.ts +12 -6
- package/upsertECRRepository.d.ts.map +1 -0
- package/upsertECRRepository.js +34 -31
- package/upsertECRRepository.js.map +1 -0
- package/upsertECRRepository.mjs +11 -8
- package/upsertECRRepository.mjs.map +1 -0
- package/copyECRImage.js.flow +0 -14
- package/copyECRImage.mjs.flow +0 -14
- package/ecrImageExists.js.flow +0 -10
- package/ecrImageExists.mjs.flow +0 -10
- package/index.js.flow +0 -8
- package/index.mjs.flow +0 -8
- package/loginToECR.js.flow +0 -6
- package/loginToECR.mjs.flow +0 -6
- package/parseECRImageUri.js.flow +0 -8
- package/parseECRImageUri.mjs.flow +0 -8
- package/tagECRImage.js.flow +0 -8
- package/tagECRImage.mjs.flow +0 -8
- package/upsertECRRepository.js.flow +0 -7
- package/upsertECRRepository.mjs.flow +0 -7
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
import z from 'zod';
|
|
2
|
+
export declare const ImageManifestSchema: z.ZodObject<{
|
|
3
|
+
schemaVersion: z.ZodLiteral<2>;
|
|
4
|
+
mediaType: z.ZodString;
|
|
5
|
+
config: z.ZodObject<{
|
|
6
|
+
mediaType: z.ZodString;
|
|
7
|
+
size: z.ZodNumber;
|
|
8
|
+
digest: z.ZodString;
|
|
9
|
+
}, "strip", z.ZodTypeAny, {
|
|
10
|
+
mediaType: string;
|
|
11
|
+
size: number;
|
|
12
|
+
digest: string;
|
|
13
|
+
}, {
|
|
14
|
+
mediaType: string;
|
|
15
|
+
size: number;
|
|
16
|
+
digest: string;
|
|
17
|
+
}>;
|
|
18
|
+
layers: z.ZodArray<z.ZodObject<{
|
|
19
|
+
mediaType: z.ZodString;
|
|
20
|
+
size: z.ZodNumber;
|
|
21
|
+
digest: z.ZodString;
|
|
22
|
+
}, "strip", z.ZodTypeAny, {
|
|
23
|
+
mediaType: string;
|
|
24
|
+
size: number;
|
|
25
|
+
digest: string;
|
|
26
|
+
}, {
|
|
27
|
+
mediaType: string;
|
|
28
|
+
size: number;
|
|
29
|
+
digest: string;
|
|
30
|
+
}>, "many">;
|
|
31
|
+
}, "strip", z.ZodTypeAny, {
|
|
32
|
+
mediaType: string;
|
|
33
|
+
schemaVersion: 2;
|
|
34
|
+
config: {
|
|
35
|
+
mediaType: string;
|
|
36
|
+
size: number;
|
|
37
|
+
digest: string;
|
|
38
|
+
};
|
|
39
|
+
layers: {
|
|
40
|
+
mediaType: string;
|
|
41
|
+
size: number;
|
|
42
|
+
digest: string;
|
|
43
|
+
}[];
|
|
44
|
+
}, {
|
|
45
|
+
mediaType: string;
|
|
46
|
+
schemaVersion: 2;
|
|
47
|
+
config: {
|
|
48
|
+
mediaType: string;
|
|
49
|
+
size: number;
|
|
50
|
+
digest: string;
|
|
51
|
+
};
|
|
52
|
+
layers: {
|
|
53
|
+
mediaType: string;
|
|
54
|
+
size: number;
|
|
55
|
+
digest: string;
|
|
56
|
+
}[];
|
|
57
|
+
}>;
|
|
58
|
+
export type ImageManifestSchema = z.infer<typeof ImageManifestSchema>;
|
|
59
|
+
//# sourceMappingURL=ImageManifestSchema.d.mts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ImageManifestSchema.d.mts","names":["z","ImageManifestSchema","ZodObject","infer"],"sources":["src/ImageManifestSchema.ts"],"sourcesContent":[null],"mappings":"AAAA,OAAOA,CAAC,MAAM,KAAK;AAYnB,qBAAaC,mBAAmB,EAAAD,CAAA,CAAAE,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK9B;AACF,OAAM,KAAMD,mBAAmB,GAAGD,CAAC,CAACG,KAAK,CAAC,OAAOF,mBAAmB,CAAC","ignoreList":[]}
|
package/ImageManifestSchema.d.ts
CHANGED
|
@@ -1,58 +1,59 @@
|
|
|
1
1
|
import z from 'zod';
|
|
2
2
|
export declare const ImageManifestSchema: z.ZodObject<{
|
|
3
|
-
|
|
3
|
+
schemaVersion: z.ZodLiteral<2>;
|
|
4
|
+
mediaType: z.ZodString;
|
|
5
|
+
config: z.ZodObject<{
|
|
4
6
|
mediaType: z.ZodString;
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
digest: string;
|
|
30
|
-
}>, "many">;
|
|
7
|
+
size: z.ZodNumber;
|
|
8
|
+
digest: z.ZodString;
|
|
9
|
+
}, "strip", z.ZodTypeAny, {
|
|
10
|
+
mediaType: string;
|
|
11
|
+
size: number;
|
|
12
|
+
digest: string;
|
|
13
|
+
}, {
|
|
14
|
+
mediaType: string;
|
|
15
|
+
size: number;
|
|
16
|
+
digest: string;
|
|
17
|
+
}>;
|
|
18
|
+
layers: z.ZodArray<z.ZodObject<{
|
|
19
|
+
mediaType: z.ZodString;
|
|
20
|
+
size: z.ZodNumber;
|
|
21
|
+
digest: z.ZodString;
|
|
22
|
+
}, "strip", z.ZodTypeAny, {
|
|
23
|
+
mediaType: string;
|
|
24
|
+
size: number;
|
|
25
|
+
digest: string;
|
|
26
|
+
}, {
|
|
27
|
+
mediaType: string;
|
|
28
|
+
size: number;
|
|
29
|
+
digest: string;
|
|
30
|
+
}>, "many">;
|
|
31
31
|
}, "strip", z.ZodTypeAny, {
|
|
32
|
+
mediaType: string;
|
|
33
|
+
schemaVersion: 2;
|
|
34
|
+
config: {
|
|
35
|
+
mediaType: string;
|
|
36
|
+
size: number;
|
|
37
|
+
digest: string;
|
|
38
|
+
};
|
|
39
|
+
layers: {
|
|
32
40
|
mediaType: string;
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
size: number;
|
|
37
|
-
digest: string;
|
|
38
|
-
};
|
|
39
|
-
layers: {
|
|
40
|
-
mediaType: string;
|
|
41
|
-
size: number;
|
|
42
|
-
digest: string;
|
|
43
|
-
}[];
|
|
41
|
+
size: number;
|
|
42
|
+
digest: string;
|
|
43
|
+
}[];
|
|
44
44
|
}, {
|
|
45
|
+
mediaType: string;
|
|
46
|
+
schemaVersion: 2;
|
|
47
|
+
config: {
|
|
48
|
+
mediaType: string;
|
|
49
|
+
size: number;
|
|
50
|
+
digest: string;
|
|
51
|
+
};
|
|
52
|
+
layers: {
|
|
45
53
|
mediaType: string;
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
size: number;
|
|
50
|
-
digest: string;
|
|
51
|
-
};
|
|
52
|
-
layers: {
|
|
53
|
-
mediaType: string;
|
|
54
|
-
size: number;
|
|
55
|
-
digest: string;
|
|
56
|
-
}[];
|
|
54
|
+
size: number;
|
|
55
|
+
digest: string;
|
|
56
|
+
}[];
|
|
57
57
|
}>;
|
|
58
58
|
export type ImageManifestSchema = z.infer<typeof ImageManifestSchema>;
|
|
59
|
+
//# sourceMappingURL=ImageManifestSchema.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ImageManifestSchema.d.ts","names":["z","ImageManifestSchema","ZodObject","infer"],"sources":["src/ImageManifestSchema.ts"],"sourcesContent":[null],"mappings":"AAAA,OAAOA,CAAC,MAAM,KAAK;AAYnB,qBAAaC,mBAAmB,EAAAD,CAAA,CAAAE,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK9B;AACF,OAAM,KAAMD,mBAAmB,GAAGD,CAAC,CAACG,KAAK,CAAC,OAAOF,mBAAmB,CAAC","ignoreList":[]}
|
package/ImageManifestSchema.js
CHANGED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ImageManifestSchema.js","names":["_zod","_interopRequireDefault","require","MediaType","z","string","min","Size","number","nonnegative","Digest","LayerSchema","object","mediaType","size","digest","ImageManifestSchema","exports","schemaVersion","literal","config","layers","array"],"sources":["src/ImageManifestSchema.ts"],"sourcesContent":[null],"mappings":";;;;;;;AAAA,IAAAA,IAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAMC,SAAS,GAAGC,eAAC,CAACC,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC;AACnC,IAAMC,IAAI,GAAGH,eAAC,CAACI,MAAM,CAAC,CAAC,OAAI,CAAC,CAAC,CAACC,WAAW,CAAC,CAAC;AAC3C,IAAMC,MAAM,GAAGN,eAAC,CAACC,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,EAAE,CAAC;AAEjC,IAAMK,WAAW,GAAGP,eAAC,CAACQ,MAAM,CAAC;EAC3BC,SAAS,EAAEV,SAAS;EACpBW,IAAI,EAAEP,IAAI;EACVQ,MAAM,EAAEL;AACV,CAAC,CAAC;AAEK,IAAMM,mBAAmB,GAAAC,OAAA,CAAAD,mBAAA,GAAGZ,eAAC,CAACQ,MAAM,CAAC;EAC1CM,aAAa,EAAEd,eAAC,CAACe,OAAO,CAAC,CAAC,CAAC;EAC3BN,SAAS,EAAET,eAAC,CAACC,MAAM,CAAC,CAAC;EACrBe,MAAM,EAAET,WAAW;EACnBU,MAAM,EAAEjB,eAAC,CAACkB,KAAK,CAACX,WAAW;AAC7B,CAAC,CAAC","ignoreList":[]}
|
package/ImageManifestSchema.mjs
CHANGED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ImageManifestSchema.mjs","names":["z","MediaType","string","min","Size","number","int","nonnegative","Digest","LayerSchema","object","mediaType","size","digest","ImageManifestSchema","schemaVersion","literal","config","layers","array"],"sources":["src/ImageManifestSchema.ts"],"sourcesContent":[null],"mappings":"AAAA,OAAOA,CAAC,MAAM,KAAK;AAEnB,MAAMC,SAAS,GAAGD,CAAC,CAACE,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC;AACnC,MAAMC,IAAI,GAAGJ,CAAC,CAACK,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAACC,WAAW,CAAC,CAAC;AAC3C,MAAMC,MAAM,GAAGR,CAAC,CAACE,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,EAAE,CAAC;AAEjC,MAAMM,WAAW,GAAGT,CAAC,CAACU,MAAM,CAAC;EAC3BC,SAAS,EAAEV,SAAS;EACpBW,IAAI,EAAER,IAAI;EACVS,MAAM,EAAEL;AACV,CAAC,CAAC;AAEF,OAAO,MAAMM,mBAAmB,GAAGd,CAAC,CAACU,MAAM,CAAC;EAC1CK,aAAa,EAAEf,CAAC,CAACgB,OAAO,CAAC,CAAC,CAAC;EAC3BL,SAAS,EAAEX,CAAC,CAACE,MAAM,CAAC,CAAC;EACrBe,MAAM,EAAER,WAAW;EACnBS,MAAM,EAAElB,CAAC,CAACmB,KAAK,CAACV,WAAW;AAC7B,CAAC,CAAC","ignoreList":[]}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
import { ECRClient, ECRClientConfig } from '@aws-sdk/client-ecr';
|
|
2
|
+
export default function checkECRImageAccess({
|
|
3
|
+
ecr,
|
|
4
|
+
awsConfig,
|
|
5
|
+
repoAccountAwsConfig,
|
|
6
|
+
imageUri,
|
|
7
|
+
log
|
|
8
|
+
}: {
|
|
9
|
+
ecr?: ECRClient;
|
|
10
|
+
awsConfig?: ECRClientConfig;
|
|
11
|
+
/**
|
|
12
|
+
* Config for the AWS account containing the ECR repository.
|
|
13
|
+
* Optional; if given, will prompt to add/update the policy on the
|
|
14
|
+
* ECR repository, if access checks failed and the terminal is
|
|
15
|
+
* interactive.
|
|
16
|
+
*/
|
|
17
|
+
repoAccountAwsConfig?: ECRClientConfig;
|
|
18
|
+
imageUri: string;
|
|
19
|
+
log?: {
|
|
20
|
+
info: (...args: any[]) => void;
|
|
21
|
+
warn: (...args: any[]) => void;
|
|
22
|
+
error: (...args: any[]) => void;
|
|
23
|
+
};
|
|
24
|
+
}): Promise<boolean>;
|
|
25
|
+
//# sourceMappingURL=checkECRImageAccess.d.mts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"checkECRImageAccess.d.mts","names":["ECRClient","ECRClientConfig","checkECRImageAccess","ecr","awsConfig","repoAccountAwsConfig","imageUri","log","info","args","warn","error","Promise"],"sources":["src/checkECRImageAccess.ts"],"sourcesContent":[null],"mappings":"AAAA,SAGEA,SAAS,EACTC,eAAe,QAIV,qBAAqB;AAQ5B,wBAA8BC,mBAAmBA,CAAC;EAChDC,GAAG;EACHC,SAAS;EACTC,oBAAoB;EACpBC,QAAQ;EACRC;CACD,EAAE;EACDJ,GAAG,CAAC,EAAEH,SAAS;EACfI,SAAS,CAAC,EAAEH,eAAe;EAC3B;;;;;;EAMAI,oBAAoB,CAAC,EAAEJ,eAAe;EACtCK,QAAQ,EAAE,MAAM;EAChBC,GAAG,CAAC,EAAE;IACJC,IAAI,EAAE,CAAC,GAAGC,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI;IAC9BC,IAAI,EAAE,CAAC,GAAGD,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI;IAC9BE,KAAK,EAAE,CAAC,GAAGF,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI;GAChC;CACF,GAAGG,OAAO,CAAC,OAAO,CAAC","ignoreList":[]}
|
package/checkECRImageAccess.d.ts
CHANGED
|
@@ -1,18 +1,26 @@
|
|
|
1
|
-
import
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
1
|
+
import { ECRClient, ECRClientConfig } from '@aws-sdk/client-ecr';
|
|
2
|
+
declare function checkECRImageAccess({
|
|
3
|
+
ecr,
|
|
4
|
+
awsConfig,
|
|
5
|
+
repoAccountAwsConfig,
|
|
6
|
+
imageUri,
|
|
7
|
+
log
|
|
8
|
+
}: {
|
|
9
|
+
ecr?: ECRClient;
|
|
10
|
+
awsConfig?: ECRClientConfig;
|
|
11
|
+
/**
|
|
12
|
+
* Config for the AWS account containing the ECR repository.
|
|
13
|
+
* Optional; if given, will prompt to add/update the policy on the
|
|
14
|
+
* ECR repository, if access checks failed and the terminal is
|
|
15
|
+
* interactive.
|
|
16
|
+
*/
|
|
17
|
+
repoAccountAwsConfig?: ECRClientConfig;
|
|
18
|
+
imageUri: string;
|
|
19
|
+
log?: {
|
|
20
|
+
info: (...args: any[]) => void;
|
|
21
|
+
warn: (...args: any[]) => void;
|
|
22
|
+
error: (...args: any[]) => void;
|
|
23
|
+
};
|
|
18
24
|
}): Promise<boolean>;
|
|
25
|
+
export = checkECRImageAccess;
|
|
26
|
+
//# sourceMappingURL=checkECRImageAccess.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"checkECRImageAccess.d.ts","names":["ECRClient","ECRClientConfig","checkECRImageAccess","ecr","awsConfig","repoAccountAwsConfig","imageUri","log","info","args","warn","error","Promise"],"sources":["src/checkECRImageAccess.ts"],"sourcesContent":[null],"mappings":"AAAA,SAGEA,SAAS,EACTC,eAAe,QAIV,qBAAqB;AAQ5B,iBAA8BC,mBAAmBA,CAAC;EAChDC,GAAG;EACHC,SAAS;EACTC,oBAAoB;EACpBC,QAAQ;EACRC;CACD,EAAE;EACDJ,GAAG,CAAC,EAAEH,SAAS;EACfI,SAAS,CAAC,EAAEH,eAAe;EAC3B;;;;;;EAMAI,oBAAoB,CAAC,EAAEJ,eAAe;EACtCK,QAAQ,EAAE,MAAM;EAChBC,GAAG,CAAC,EAAE;IACJC,IAAI,EAAE,CAAC,GAAGC,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI;IAC9BC,IAAI,EAAE,CAAC,GAAGD,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI;IAC9BE,KAAK,EAAE,CAAC,GAAGF,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI;GAChC;CACF,GAAGG,OAAO,CAAC,OAAO,CAAC;AA0JnB,SAAAV,mBAAA","ignoreList":[]}
|
package/checkECRImageAccess.js
CHANGED
|
@@ -6,11 +6,12 @@ Object.defineProperty(exports, "__esModule", {
|
|
|
6
6
|
});
|
|
7
7
|
exports["default"] = checkECRImageAccess;
|
|
8
8
|
var _regenerator = _interopRequireDefault(require("@babel/runtime/regenerator"));
|
|
9
|
+
var _typeof2 = _interopRequireDefault(require("@babel/runtime/helpers/typeof"));
|
|
9
10
|
var _toConsumableArray2 = _interopRequireDefault(require("@babel/runtime/helpers/toConsumableArray"));
|
|
10
|
-
var _slicedToArray2 = _interopRequireDefault(require("@babel/runtime/helpers/slicedToArray"));
|
|
11
11
|
var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
|
|
12
12
|
var _asyncToGenerator2 = _interopRequireDefault(require("@babel/runtime/helpers/asyncToGenerator"));
|
|
13
|
-
var
|
|
13
|
+
var _clientEcr = require("@aws-sdk/client-ecr");
|
|
14
|
+
var _clientSts = require("@aws-sdk/client-sts");
|
|
14
15
|
var _parseECRImageUri2 = _interopRequireDefault(require("./parseECRImageUri.js"));
|
|
15
16
|
var _ImageManifestSchema = require("./ImageManifestSchema.js");
|
|
16
17
|
var _isInteractive = _interopRequireDefault(require("is-interactive"));
|
|
@@ -22,67 +23,65 @@ function checkECRImageAccess(_x) {
|
|
|
22
23
|
return _checkECRImageAccess.apply(this, arguments);
|
|
23
24
|
}
|
|
24
25
|
function _checkECRImageAccess() {
|
|
25
|
-
_checkECRImageAccess = (0, _asyncToGenerator2["default"])(
|
|
26
|
-
var ecr, awsConfig, repoAccountAwsConfig, imageUri, _ref$log, log, _parseECRImageUri, registryId, region, repositoryName, imageTag,
|
|
27
|
-
return _regenerator["default"].wrap(function
|
|
26
|
+
_checkECRImageAccess = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator["default"].mark(function _callee(_ref) {
|
|
27
|
+
var ecr, awsConfig, repoAccountAwsConfig, imageUri, _ref$log, log, _parseECRImageUri, registryId, region, repositoryName, imageTag, _images$, _yield$ecr$send, _yield$ecr$send$image, images, imageManifest, _ImageManifestSchema$, config, layers, Action, _yield$STSClient$send, Account, _yield$inquirer$promp, update, srcEcr, _yield$srcEcr$send$ca, policyText, policy, _t;
|
|
28
|
+
return _regenerator["default"].wrap(function (_context) {
|
|
28
29
|
while (1) switch (_context.prev = _context.next) {
|
|
29
30
|
case 0:
|
|
30
31
|
ecr = _ref.ecr, awsConfig = _ref.awsConfig, repoAccountAwsConfig = _ref.repoAccountAwsConfig, imageUri = _ref.imageUri, _ref$log = _ref.log, log = _ref$log === void 0 ? console : _ref$log;
|
|
31
32
|
log.error('checking access to ECR image:', imageUri, '...');
|
|
32
33
|
_parseECRImageUri = (0, _parseECRImageUri2["default"])(imageUri), registryId = _parseECRImageUri.registryId, region = _parseECRImageUri.region, repositoryName = _parseECRImageUri.repositoryName, imageTag = _parseECRImageUri.imageTag;
|
|
33
|
-
if (!ecr) ecr = new
|
|
34
|
+
if (!ecr) ecr = new _clientEcr.ECRClient(_objectSpread(_objectSpread({}, awsConfig), {}, {
|
|
34
35
|
region: region
|
|
35
36
|
}));
|
|
36
|
-
_context.prev =
|
|
37
|
-
_context.next =
|
|
38
|
-
return ecr.
|
|
37
|
+
_context.prev = 1;
|
|
38
|
+
_context.next = 2;
|
|
39
|
+
return ecr.send(new _clientEcr.BatchGetImageCommand({
|
|
39
40
|
registryId: registryId,
|
|
40
41
|
repositoryName: repositoryName,
|
|
41
42
|
imageIds: [{
|
|
42
43
|
imageTag: imageTag
|
|
43
44
|
}]
|
|
44
|
-
})
|
|
45
|
-
case
|
|
46
|
-
_yield$ecr$
|
|
47
|
-
_yield$ecr$
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
image = _yield$ecr$batchGetIm4[0];
|
|
51
|
-
imageManifest = image === null || image === void 0 ? void 0 : image.imageManifest;
|
|
45
|
+
}));
|
|
46
|
+
case 2:
|
|
47
|
+
_yield$ecr$send = _context.sent;
|
|
48
|
+
_yield$ecr$send$image = _yield$ecr$send.images;
|
|
49
|
+
images = _yield$ecr$send$image === void 0 ? [] : _yield$ecr$send$image;
|
|
50
|
+
imageManifest = (_images$ = images[0]) === null || _images$ === void 0 ? void 0 : _images$.imageManifest;
|
|
52
51
|
if (imageManifest) {
|
|
53
|
-
_context.next =
|
|
52
|
+
_context.next = 3;
|
|
54
53
|
break;
|
|
55
54
|
}
|
|
56
55
|
throw new Error("imageManifest not found for: ".concat(imageUri));
|
|
57
|
-
case
|
|
56
|
+
case 3:
|
|
58
57
|
_ImageManifestSchema$ = _ImageManifestSchema.ImageManifestSchema.parse(JSON.parse(imageManifest)), config = _ImageManifestSchema$.config, layers = _ImageManifestSchema$.layers;
|
|
59
|
-
_context.next =
|
|
60
|
-
return ecr.
|
|
58
|
+
_context.next = 4;
|
|
59
|
+
return ecr.send(new _clientEcr.BatchCheckLayerAvailabilityCommand({
|
|
61
60
|
registryId: registryId,
|
|
62
61
|
repositoryName: repositoryName,
|
|
63
62
|
layerDigests: [config.digest].concat((0, _toConsumableArray2["default"])(layers.map(function (l) {
|
|
64
63
|
return l.digest;
|
|
65
64
|
})))
|
|
66
|
-
})
|
|
67
|
-
case
|
|
68
|
-
_context.next =
|
|
69
|
-
return ecr.
|
|
65
|
+
}));
|
|
66
|
+
case 4:
|
|
67
|
+
_context.next = 5;
|
|
68
|
+
return ecr.send(new _clientEcr.GetDownloadUrlForLayerCommand({
|
|
70
69
|
registryId: registryId,
|
|
71
70
|
repositoryName: repositoryName,
|
|
72
71
|
layerDigest: layers[0].digest
|
|
73
|
-
})
|
|
74
|
-
case
|
|
72
|
+
}));
|
|
73
|
+
case 5:
|
|
75
74
|
log.error("ECR image is accessible: ".concat(imageUri));
|
|
76
75
|
return _context.abrupt("return", true);
|
|
77
|
-
case
|
|
78
|
-
_context.prev =
|
|
79
|
-
|
|
80
|
-
if (!(!(
|
|
81
|
-
_context.next =
|
|
76
|
+
case 6:
|
|
77
|
+
_context.prev = 6;
|
|
78
|
+
_t = _context["catch"](1);
|
|
79
|
+
if (!(!(_t instanceof Error) || _t.name !== 'AccessDeniedException')) {
|
|
80
|
+
_context.next = 7;
|
|
82
81
|
break;
|
|
83
82
|
}
|
|
84
|
-
throw
|
|
85
|
-
case
|
|
83
|
+
throw _t;
|
|
84
|
+
case 7:
|
|
86
85
|
log.error("Unable to access ECR image: ".concat(imageUri));
|
|
87
86
|
Action = ['ecr:GetDownloadUrlForLayer', 'ecr:BatchCheckLayerAvailability', 'ecr:BatchGetImage'];
|
|
88
87
|
log.error("You may need to add a policy to the ECR repository to allow this account.\n\nThe policy should include:\n\n ".concat(JSON.stringify({
|
|
@@ -96,57 +95,57 @@ function _checkECRImageAccess() {
|
|
|
96
95
|
}]
|
|
97
96
|
}, null, 2).replace(/\n/gm, '\n '), "\n"));
|
|
98
97
|
if (!(repoAccountAwsConfig && (0, _isInteractive["default"])())) {
|
|
99
|
-
_context.next =
|
|
98
|
+
_context.next = 15;
|
|
100
99
|
break;
|
|
101
100
|
}
|
|
102
|
-
_context.next =
|
|
103
|
-
return new
|
|
101
|
+
_context.next = 8;
|
|
102
|
+
return new _clientSts.STSClient({
|
|
104
103
|
credentials: ecr.config.credentials,
|
|
105
104
|
region: region
|
|
106
|
-
}).
|
|
107
|
-
case
|
|
108
|
-
_yield$
|
|
109
|
-
Account = _yield$
|
|
105
|
+
}).send(new _clientSts.GetCallerIdentityCommand());
|
|
106
|
+
case 8:
|
|
107
|
+
_yield$STSClient$send = _context.sent;
|
|
108
|
+
Account = _yield$STSClient$send.Account;
|
|
110
109
|
if (Account) {
|
|
111
|
-
_context.next =
|
|
110
|
+
_context.next = 9;
|
|
112
111
|
break;
|
|
113
112
|
}
|
|
114
113
|
log.error("failed to determine AWS account");
|
|
115
114
|
return _context.abrupt("return", false);
|
|
116
|
-
case
|
|
117
|
-
_context.next =
|
|
115
|
+
case 9:
|
|
116
|
+
_context.next = 10;
|
|
118
117
|
return _inquirer["default"].prompt([{
|
|
119
118
|
name: 'update',
|
|
120
119
|
message: 'Do you want to add/update the policy?',
|
|
121
120
|
type: 'confirm',
|
|
122
121
|
"default": false
|
|
123
122
|
}]);
|
|
124
|
-
case
|
|
123
|
+
case 10:
|
|
125
124
|
_yield$inquirer$promp = _context.sent;
|
|
126
125
|
update = _yield$inquirer$promp.update;
|
|
127
126
|
if (update) {
|
|
128
|
-
_context.next =
|
|
127
|
+
_context.next = 11;
|
|
129
128
|
break;
|
|
130
129
|
}
|
|
131
130
|
return _context.abrupt("return", false);
|
|
132
|
-
case
|
|
133
|
-
srcEcr = new
|
|
131
|
+
case 11:
|
|
132
|
+
srcEcr = new _clientEcr.ECRClient(_objectSpread(_objectSpread({}, repoAccountAwsConfig), {}, {
|
|
134
133
|
region: region
|
|
135
134
|
}));
|
|
136
|
-
_context.next =
|
|
137
|
-
return srcEcr.
|
|
135
|
+
_context.next = 12;
|
|
136
|
+
return srcEcr.send(new _clientEcr.GetRepositoryPolicyCommand({
|
|
138
137
|
registryId: registryId,
|
|
139
138
|
repositoryName: repositoryName
|
|
140
|
-
})
|
|
141
|
-
if (error.name === 'RepositoryPolicyNotFoundException') return {};
|
|
139
|
+
}))["catch"](function (error) {
|
|
140
|
+
if (error && (0, _typeof2["default"])(error) === 'object' && 'name' in error && error.name === 'RepositoryPolicyNotFoundException') return {};
|
|
142
141
|
throw error;
|
|
143
142
|
});
|
|
144
|
-
case
|
|
145
|
-
_yield$srcEcr$
|
|
146
|
-
policyText = _yield$srcEcr$
|
|
143
|
+
case 12:
|
|
144
|
+
_yield$srcEcr$send$ca = _context.sent;
|
|
145
|
+
policyText = _yield$srcEcr$send$ca.policyText;
|
|
147
146
|
policy = JSON.parse(policyText || '{}');
|
|
148
|
-
_context.next =
|
|
149
|
-
return srcEcr.
|
|
147
|
+
_context.next = 13;
|
|
148
|
+
return srcEcr.send(new _clientEcr.SetRepositoryPolicyCommand({
|
|
150
149
|
repositoryName: repositoryName,
|
|
151
150
|
policyText: JSON.stringify(_objectSpread(_objectSpread({
|
|
152
151
|
Version: '2012-10-17'
|
|
@@ -159,30 +158,31 @@ function _checkECRImageAccess() {
|
|
|
159
158
|
Action: Action
|
|
160
159
|
}])
|
|
161
160
|
}), null, 2)
|
|
162
|
-
})
|
|
163
|
-
case
|
|
161
|
+
}));
|
|
162
|
+
case 13:
|
|
164
163
|
log.info("updated policy on ECR repository ".concat((0, _formatECRRepositoryHostname["default"])({
|
|
165
164
|
registryId: registryId,
|
|
166
165
|
region: region,
|
|
167
166
|
repositoryName: repositoryName
|
|
168
167
|
})));
|
|
169
|
-
_context.next =
|
|
168
|
+
_context.next = 14;
|
|
170
169
|
return checkECRImageAccess({
|
|
171
170
|
awsConfig: awsConfig,
|
|
172
171
|
imageUri: imageUri,
|
|
173
172
|
log: log,
|
|
174
173
|
ecr: ecr
|
|
175
174
|
});
|
|
176
|
-
case
|
|
175
|
+
case 14:
|
|
177
176
|
return _context.abrupt("return", _context.sent);
|
|
178
|
-
case
|
|
177
|
+
case 15:
|
|
179
178
|
return _context.abrupt("return", false);
|
|
180
|
-
case
|
|
179
|
+
case 16:
|
|
181
180
|
case "end":
|
|
182
181
|
return _context.stop();
|
|
183
182
|
}
|
|
184
|
-
}, _callee, null, [[
|
|
183
|
+
}, _callee, null, [[1, 6]]);
|
|
185
184
|
}));
|
|
186
185
|
return _checkECRImageAccess.apply(this, arguments);
|
|
187
186
|
}
|
|
188
|
-
module.exports = exports.default;
|
|
187
|
+
module.exports = exports.default;
|
|
188
|
+
//# sourceMappingURL=checkECRImageAccess.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"checkECRImageAccess.js","names":["_clientEcr","require","_clientSts","_parseECRImageUri2","_interopRequireDefault","_ImageManifestSchema","_isInteractive","_inquirer","_formatECRRepositoryHostname","ownKeys","e","r","t","Object","keys","getOwnPropertySymbols","o","filter","getOwnPropertyDescriptor","enumerable","push","apply","_objectSpread","arguments","length","forEach","_defineProperty2","getOwnPropertyDescriptors","defineProperties","defineProperty","checkECRImageAccess","_x","_checkECRImageAccess","_asyncToGenerator2","_regenerator","mark","_callee","_ref","ecr","awsConfig","repoAccountAwsConfig","imageUri","_ref$log","log","_parseECRImageUri","registryId","region","repositoryName","imageTag","_images$","_yield$ecr$send","_yield$ecr$send$image","images","imageManifest","_ImageManifestSchema$","config","layers","Action","_yield$STSClient$send","Account","_yield$inquirer$promp","update","srcEcr","_yield$srcEcr$send$ca","policyText","policy","_t","wrap","_context","prev","next","console","error","parseECRImageUri","ECRClient","send","BatchGetImageCommand","imageIds","sent","Error","concat","ImageManifestSchema","parse","JSON","BatchCheckLayerAvailabilityCommand","layerDigests","digest","_toConsumableArray2","map","l","GetDownloadUrlForLayerCommand","layerDigest","abrupt","name","stringify","Version","Statement","Effect","Principal","AWS","replace","isInteractive","STSClient","credentials","GetCallerIdentityCommand","inquirer","prompt","message","type","GetRepositoryPolicyCommand","_typeof2","SetRepositoryPolicyCommand","info","formatECRRepositoryHostname","stop","module","exports","default"],"sources":["src/checkECRImageAccess.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;AAAA,IAAAA,UAAA,GAAAC,OAAA;AASA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,kBAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,oBAAA,GAAAJ,OAAA;AACA,IAAAK,cAAA,GAAAF,sBAAA,CAAAH,OAAA;AACA,IAAAM,SAAA,GAAAH,sBAAA,CAAAH,OAAA;AACA,IAAAO,4BAAA,GAAAJ,sBAAA,CAAAH,OAAA;AAAuE,SAAAQ,QAAAC,CAAA,EAAAC,CAAA,QAAAC,CAAA,GAAAC,MAAA,CAAAC,IAAA,CAAAJ,CAAA,OAAAG,MAAA,CAAAE,qBAAA,QAAAC,CAAA,GAAAH,MAAA,CAAAE,qBAAA,CAAAL,CAAA,GAAAC,CAAA,KAAAK,CAAA,GAAAA,CAAA,CAAAC,MAAA,WAAAN,CAAA,WAAAE,MAAA,CAAAK,wBAAA,CAAAR,CAAA,EAAAC,CAAA,EAAAQ,UAAA,OAAAP,CAAA,CAAAQ,IAAA,CAAAC,KAAA,CAAAT,CAAA,EAAAI,CAAA,YAAAJ,CAAA;AAAA,SAAAU,cAAAZ,CAAA,aAAAC,CAAA,MAAAA,CAAA,GAAAY,SAAA,CAAAC,MAAA,EAAAb,CAAA,UAAAC,CAAA,WAAAW,SAAA,CAAAZ,CAAA,IAAAY,SAAA,CAAAZ,CAAA,QAAAA,CAAA,OAAAF,OAAA,CAAAI,MAAA,CAAAD,CAAA,OAAAa,OAAA,WAAAd,CAAA,QAAAe,gBAAA,aAAAhB,CAAA,EAAAC,CAAA,EAAAC,CAAA,CAAAD,CAAA,SAAAE,MAAA,CAAAc,yBAAA,GAAAd,MAAA,CAAAe,gBAAA,CAAAlB,CAAA,EAAAG,MAAA,CAAAc,yBAAA,CAAAf,CAAA,KAAAH,OAAA,CAAAI,MAAA,CAAAD,CAAA,GAAAa,OAAA,WAAAd,CAAA,IAAAE,MAAA,CAAAgB,cAAA,CAAAnB,CAAA,EAAAC,CAAA,EAAAE,MAAA,CAAAK,wBAAA,CAAAN,CAAA,EAAAD,CAAA,iBAAAD,CAAA;AAAA,SAEzCoB,mBAAmBA,CAAAC,EAAA;EAAA,OAAAC,oBAAA,CAAAX,KAAA,OAAAE,SAAA;AAAA;AAAA,SAAAS,qBAAA;EAAAA,oBAAA,OAAAC,kBAAA,0BAAAC,YAAA,YAAAC,IAAA,CAAlC,SAAAC,QAAAC,IAAA;IAAA,IAAAC,GAAA,EAAAC,SAAA,EAAAC,oBAAA,EAAAC,QAAA,EAAAC,QAAA,EAAAC,GAAA,EAAAC,iBAAA,EAAAC,UAAA,EAAAC,MAAA,EAAAC,cAAA,EAAAC,QAAA,EAAAC,QAAA,EAAAC,eAAA,EAAAC,qBAAA,EAAAC,MAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,MAAA,EAAAC,MAAA,EAAAC,MAAA,EAAAC,qBAAA,EAAAC,OAAA,EAAAC,qBAAA,EAAAC,MAAA,EAAAC,MAAA,EAAAC,qBAAA,EAAAC,UAAA,EAAAC,MAAA,EAAAC,EAAA;IAAA,OAAAhC,YAAA,YAAAiC,IAAA,WAAAC,QAAA;MAAA,kBAAAA,QAAA,CAAAC,IAAA,GAAAD,QAAA,CAAAE,IAAA;QAAA;UACbhC,GAAG,GAAAD,IAAA,CAAHC,GAAG,EACHC,SAAS,GAAAF,IAAA,CAATE,SAAS,EACTC,oBAAoB,GAAAH,IAAA,CAApBG,oBAAoB,EACpBC,QAAQ,GAAAJ,IAAA,CAARI,QAAQ,EAAAC,QAAA,GAAAL,IAAA,CACRM,GAAG,EAAHA,GAAG,GAAAD,QAAA,cAAG6B,OAAO,GAAA7B,QAAA;UAkBbC,GAAG,CAAC6B,KAAK,CAAC,+BAA+B,EAAE/B,QAAQ,EAAE,KAAK,CAAC;UAAAG,iBAAA,GAGzD,IAAA6B,6BAAgB,EAAChC,QAAQ,CAAC,EADpBI,UAAU,GAAAD,iBAAA,CAAVC,UAAU,EAAEC,MAAM,GAAAF,iBAAA,CAANE,MAAM,EAAEC,cAAc,GAAAH,iBAAA,CAAdG,cAAc,EAAEC,QAAQ,GAAAJ,iBAAA,CAARI,QAAQ;UAEpD,IAAI,CAACV,GAAG,EAAEA,GAAG,GAAG,IAAIoC,oBAAS,CAAApD,aAAA,CAAAA,aAAA,KAAMiB,SAAS;YAAEO,MAAM,EAANA;UAAM,EAAE,CAAC;UAAAsB,QAAA,CAAAC,IAAA;UAAAD,QAAA,CAAAE,IAAA;UAAA,OAGvBhC,GAAG,CAACqC,IAAI,CACpC,IAAIC,+BAAoB,CAAC;YACvB/B,UAAU,EAAVA,UAAU;YACVE,cAAc,EAAdA,cAAc;YACd8B,QAAQ,EAAE,CAAC;cAAE7B,QAAQ,EAARA;YAAS,CAAC;UACzB,CAAC,CACH,CAAC;QAAA;UAAAE,eAAA,GAAAkB,QAAA,CAAAU,IAAA;UAAA3B,qBAAA,GAAAD,eAAA,CANOE,MAAM;UAANA,MAAM,GAAAD,qBAAA,cAAG,EAAE,GAAAA,qBAAA;UAQbE,aAAa,IAAAJ,QAAA,GAAGG,MAAM,CAAC,CAAC,CAAC,cAAAH,QAAA,uBAATA,QAAA,CAAWI,aAAa;UAAA,IAEzCA,aAAa;YAAAe,QAAA,CAAAE,IAAA;YAAA;UAAA;UAAA,MACV,IAAIS,KAAK,iCAAAC,MAAA,CAAiCvC,QAAQ,CAAE,CAAC;QAAA;UAAAa,qBAAA,GAElC2B,wCAAmB,CAACC,KAAK,CAClDC,IAAI,CAACD,KAAK,CAAC7B,aAAa,CAC1B,CAAC,EAFOE,MAAM,GAAAD,qBAAA,CAANC,MAAM,EAAEC,MAAM,GAAAF,qBAAA,CAANE,MAAM;UAAAY,QAAA,CAAAE,IAAA;UAAA,OAIhBhC,GAAG,CAACqC,IAAI,CACZ,IAAIS,6CAAkC,CAAC;YACrCvC,UAAU,EAAVA,UAAU;YACVE,cAAc,EAAdA,cAAc;YACdsC,YAAY,GAAG9B,MAAM,CAAC+B,MAAM,EAAAN,MAAA,KAAAO,mBAAA,aAAK/B,MAAM,CAACgC,GAAG,CAAC,UAACC,CAAC;cAAA,OAAKA,CAAC,CAACH,MAAM;YAAA,EAAC;UAC9D,CAAC,CACH,CAAC;QAAA;UAAAlB,QAAA,CAAAE,IAAA;UAAA,OAEKhC,GAAG,CAACqC,IAAI,CACZ,IAAIe,wCAA6B,CAAC;YAChC7C,UAAU,EAAVA,UAAU;YACVE,cAAc,EAAdA,cAAc;YACd4C,WAAW,EAAEnC,MAAM,CAAC,CAAC,CAAC,CAAC8B;UACzB,CAAC,CACH,CAAC;QAAA;UAED3C,GAAG,CAAC6B,KAAK,6BAAAQ,MAAA,CAA6BvC,QAAQ,CAAE,CAAC;UAAA,OAAA2B,QAAA,CAAAwB,MAAA,WAC1C,IAAI;QAAA;UAAAxB,QAAA,CAAAC,IAAA;UAAAH,EAAA,GAAAE,QAAA;UAAA,MAEP,EAAEF,EAAA,YAAiBa,KAAK,CAAC,IAAIb,EAAA,CAAM2B,IAAI,KAAK,uBAAuB;YAAAzB,QAAA,CAAAE,IAAA;YAAA;UAAA;UAAA,MAAAJ,EAAA;QAAA;UAIzEvB,GAAG,CAAC6B,KAAK,gCAAAQ,MAAA,CAAgCvC,QAAQ,CAAE,CAAC;UAE9CgB,MAAM,GAAG,CACb,4BAA4B,EAC5B,iCAAiC,EACjC,mBAAmB,CACpB;UAEDd,GAAG,CAAC6B,KAAK,iHAAAQ,MAAA,CAIPG,IAAI,CAACW,SAAS,CACd;YACEC,OAAO,EAAE,YAAY;YACrBC,SAAS,EAAE,CACT;cACEC,MAAM,EAAE,OAAO;cACfC,SAAS,EAAE;gBACTC,GAAG,EAAE,CAAC,cAAc;cACtB,CAAC;cACD1C,MAAM,EAANA;YACF,CAAC;UAEL,CAAC,EACD,IAAI,EACJ,CACF,CAAC,CAAC2C,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,OAC1B,CAAC;UAAA,MAEI5D,oBAAoB,IAAI,IAAA6D,yBAAa,EAAC,CAAC;YAAAjC,QAAA,CAAAE,IAAA;YAAA;UAAA;UAAAF,QAAA,CAAAE,IAAA;UAAA,OACf,IAAIgC,oBAAS,CAAC;YACtCC,WAAW,EAAEjE,GAAG,CAACiB,MAAM,CAACgD,WAAW;YACnCzD,MAAM,EAANA;UACF,CAAC,CAAC,CAAC6B,IAAI,CAAC,IAAI6B,mCAAwB,CAAC,CAAC,CAAC;QAAA;UAAA9C,qBAAA,GAAAU,QAAA,CAAAU,IAAA;UAH/BnB,OAAO,GAAAD,qBAAA,CAAPC,OAAO;UAAA,IAIVA,OAAO;YAAAS,QAAA,CAAAE,IAAA;YAAA;UAAA;UACV3B,GAAG,CAAC6B,KAAK,kCAAkC,CAAC;UAAA,OAAAJ,QAAA,CAAAwB,MAAA,WACrC,KAAK;QAAA;UAAAxB,QAAA,CAAAE,IAAA;UAAA,OAGWmC,oBAAQ,CAACC,MAAM,CAAC,CACvC;YACEb,IAAI,EAAE,QAAQ;YACdc,OAAO,EAAE,uCAAuC;YAChDC,IAAI,EAAE,SAAS;YACf,WAAS;UACX,CAAC,CACF,CAAC;QAAA;UAAAhD,qBAAA,GAAAQ,QAAA,CAAAU,IAAA;UAPMjB,MAAM,GAAAD,qBAAA,CAANC,MAAM;UAAA,IAQTA,MAAM;YAAAO,QAAA,CAAAE,IAAA;YAAA;UAAA;UAAA,OAAAF,QAAA,CAAAwB,MAAA,WAAS,KAAK;QAAA;UAEnB9B,MAAM,GAAG,IAAIY,oBAAS,CAAApD,aAAA,CAAAA,aAAA,KACvBkB,oBAAoB;YACvBM,MAAM,EAANA;UAAM,EACP,CAAC;UAAAsB,QAAA,CAAAE,IAAA;UAAA,OAC2BR,MAAM,CAChCa,IAAI,CACH,IAAIkC,qCAA0B,CAAC;YAC7BhE,UAAU,EAAVA,UAAU;YACVE,cAAc,EAAdA;UACF,CAAC,CACH,CAAC,SACK,CAAC,UAACyB,KAAc,EAA8B;YAClD,IACEA,KAAK,IACL,IAAAsC,QAAA,aAAOtC,KAAK,MAAK,QAAQ,IACzB,MAAM,IAAIA,KAAK,IACfA,KAAK,CAACqB,IAAI,KAAK,mCAAmC,EAElD,OAAO,CAAC,CAAC;YACX,MAAMrB,KAAK;UACb,CAAC,CAAC;QAAA;UAAAT,qBAAA,GAAAK,QAAA,CAAAU,IAAA;UAhBId,UAAU,GAAAD,qBAAA,CAAVC,UAAU;UAkBZC,MAAW,GAAGkB,IAAI,CAACD,KAAK,CAAClB,UAAU,IAAI,IAAI,CAAC;UAAAI,QAAA,CAAAE,IAAA;UAAA,OAC5CR,MAAM,CAACa,IAAI,CACf,IAAIoC,qCAA0B,CAAC;YAC7BhE,cAAc,EAAdA,cAAc;YACdiB,UAAU,EAAEmB,IAAI,CAACW,SAAS,CAAAxE,aAAA,CAAAA,aAAA;cAEtByE,OAAO,EAAE;YAAY,GAClB9B,MAAM;cACT+B,SAAS,KAAAhB,MAAA,KAAAO,mBAAA,aACHtB,MAAM,CAAC+B,SAAS,IAAI,EAAE,IAC1B;gBACEC,MAAM,EAAE,OAAO;gBACfC,SAAS,EAAE;kBACTC,GAAG,EAAE,CAACxC,OAAO;gBACf,CAAC;gBACDF,MAAM,EAANA;cACF,CAAC;YACF,IAEH,IAAI,EACJ,CACF;UACF,CAAC,CACH,CAAC;QAAA;UACDd,GAAG,CAACqE,IAAI,qCAAAhC,MAAA,CAC8B,IAAAiC,uCAA2B,EAAC;YAC9DpE,UAAU,EAAVA,UAAU;YACVC,MAAM,EAANA,MAAM;YACNC,cAAc,EAAdA;UACF,CAAC,CAAC,CACJ,CAAC;UAAAqB,QAAA,CAAAE,IAAA;UAAA,OACYxC,mBAAmB,CAAC;YAAES,SAAS,EAATA,SAAS;YAAEE,QAAQ,EAARA,QAAQ;YAAEE,GAAG,EAAHA,GAAG;YAAEL,GAAG,EAAHA;UAAI,CAAC,CAAC;QAAA;UAAA,OAAA8B,QAAA,CAAAwB,MAAA,WAAAxB,QAAA,CAAAU,IAAA;QAAA;UAAA,OAAAV,QAAA,CAAAwB,MAAA,WAE9D,KAAK;QAAA;QAAA;UAAA,OAAAxB,QAAA,CAAA8C,IAAA;MAAA;IAAA,GAAA9E,OAAA;EAAA,CACb;EAAA,OAAAJ,oBAAA,CAAAX,KAAA,OAAAE,SAAA;AAAA;AAAA4F,MAAA,CAAAC,OAAA,GAAAA,OAAA,CAAAC,OAAA","ignoreList":[]}
|
package/checkECRImageAccess.mjs
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import
|
|
1
|
+
import { BatchCheckLayerAvailabilityCommand, BatchGetImageCommand, ECRClient, GetDownloadUrlForLayerCommand, GetRepositoryPolicyCommand, SetRepositoryPolicyCommand } from '@aws-sdk/client-ecr';
|
|
2
|
+
import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
|
|
2
3
|
import parseECRImageUri from "./parseECRImageUri.mjs";
|
|
3
4
|
import { ImageManifestSchema } from "./ImageManifestSchema.mjs";
|
|
4
5
|
import isInteractive from 'is-interactive';
|
|
@@ -18,21 +19,22 @@ export default async function checkECRImageAccess({
|
|
|
18
19
|
repositoryName,
|
|
19
20
|
imageTag
|
|
20
21
|
} = parseECRImageUri(imageUri);
|
|
21
|
-
if (!ecr) ecr = new
|
|
22
|
+
if (!ecr) ecr = new ECRClient({
|
|
22
23
|
...awsConfig,
|
|
23
24
|
region
|
|
24
25
|
});
|
|
25
26
|
try {
|
|
27
|
+
var _images$;
|
|
26
28
|
const {
|
|
27
|
-
images
|
|
28
|
-
} = await ecr.
|
|
29
|
+
images = []
|
|
30
|
+
} = await ecr.send(new BatchGetImageCommand({
|
|
29
31
|
registryId,
|
|
30
32
|
repositoryName,
|
|
31
33
|
imageIds: [{
|
|
32
34
|
imageTag
|
|
33
35
|
}]
|
|
34
|
-
})
|
|
35
|
-
const imageManifest =
|
|
36
|
+
}));
|
|
37
|
+
const imageManifest = (_images$ = images[0]) === null || _images$ === void 0 ? void 0 : _images$.imageManifest;
|
|
36
38
|
if (!imageManifest) {
|
|
37
39
|
throw new Error(`imageManifest not found for: ${imageUri}`);
|
|
38
40
|
}
|
|
@@ -40,16 +42,16 @@ export default async function checkECRImageAccess({
|
|
|
40
42
|
config,
|
|
41
43
|
layers
|
|
42
44
|
} = ImageManifestSchema.parse(JSON.parse(imageManifest));
|
|
43
|
-
await ecr.
|
|
45
|
+
await ecr.send(new BatchCheckLayerAvailabilityCommand({
|
|
44
46
|
registryId,
|
|
45
47
|
repositoryName,
|
|
46
48
|
layerDigests: [config.digest, ...layers.map(l => l.digest)]
|
|
47
|
-
})
|
|
48
|
-
await ecr.
|
|
49
|
+
}));
|
|
50
|
+
await ecr.send(new GetDownloadUrlForLayerCommand({
|
|
49
51
|
registryId,
|
|
50
52
|
repositoryName,
|
|
51
53
|
layerDigest: layers[0].digest
|
|
52
|
-
})
|
|
54
|
+
}));
|
|
53
55
|
log.error(`ECR image is accessible: ${imageUri}`);
|
|
54
56
|
return true;
|
|
55
57
|
} catch (error) {
|
|
@@ -77,10 +79,10 @@ The policy should include:
|
|
|
77
79
|
if (repoAccountAwsConfig && isInteractive()) {
|
|
78
80
|
const {
|
|
79
81
|
Account
|
|
80
|
-
} = await new
|
|
82
|
+
} = await new STSClient({
|
|
81
83
|
credentials: ecr.config.credentials,
|
|
82
84
|
region
|
|
83
|
-
}).
|
|
85
|
+
}).send(new GetCallerIdentityCommand());
|
|
84
86
|
if (!Account) {
|
|
85
87
|
log.error(`failed to determine AWS account`);
|
|
86
88
|
return false;
|
|
@@ -94,21 +96,21 @@ The policy should include:
|
|
|
94
96
|
default: false
|
|
95
97
|
}]);
|
|
96
98
|
if (!update) return false;
|
|
97
|
-
const srcEcr = new
|
|
99
|
+
const srcEcr = new ECRClient({
|
|
98
100
|
...repoAccountAwsConfig,
|
|
99
101
|
region
|
|
100
102
|
});
|
|
101
103
|
const {
|
|
102
104
|
policyText
|
|
103
|
-
} = await srcEcr.
|
|
105
|
+
} = await srcEcr.send(new GetRepositoryPolicyCommand({
|
|
104
106
|
registryId,
|
|
105
107
|
repositoryName
|
|
106
|
-
})
|
|
107
|
-
if (error.name === 'RepositoryPolicyNotFoundException') return {};
|
|
108
|
+
})).catch(error => {
|
|
109
|
+
if (error && typeof error === 'object' && 'name' in error && error.name === 'RepositoryPolicyNotFoundException') return {};
|
|
108
110
|
throw error;
|
|
109
111
|
});
|
|
110
112
|
const policy = JSON.parse(policyText || '{}');
|
|
111
|
-
await srcEcr.
|
|
113
|
+
await srcEcr.send(new SetRepositoryPolicyCommand({
|
|
112
114
|
repositoryName,
|
|
113
115
|
policyText: JSON.stringify({
|
|
114
116
|
Version: '2012-10-17',
|
|
@@ -121,7 +123,7 @@ The policy should include:
|
|
|
121
123
|
Action
|
|
122
124
|
}]
|
|
123
125
|
}, null, 2)
|
|
124
|
-
})
|
|
126
|
+
}));
|
|
125
127
|
log.info(`updated policy on ECR repository ${formatECRRepositoryHostname({
|
|
126
128
|
registryId,
|
|
127
129
|
region,
|
|
@@ -135,4 +137,5 @@ The policy should include:
|
|
|
135
137
|
});
|
|
136
138
|
}
|
|
137
139
|
return false;
|
|
138
|
-
}
|
|
140
|
+
}
|
|
141
|
+
//# sourceMappingURL=checkECRImageAccess.mjs.map
|