@jcoreio/aws-ecr-utils 1.3.1 → 2.1.0

package/loginToECR.mjs

@@ -1,21 +1,50 @@
 /**
  * @prettier
  */
-import AWS from 'aws-sdk';
 import { spawn } from 'promisify-child-process';
 import base64 from 'base64-js';
+import { ECRClient, GetAuthorizationTokenCommand } from '@aws-sdk/client-ecr';
+import parseECRImageUri from "./parseECRImageUri.mjs";
+import * as log4jcore from 'log4jcore';
+const log = log4jcore.logger('@jcoreio/aws-ecr-utils/loginToECR');
 export default async function loginToECR({
   ecr,
+  forImages,
   awsConfig
 }) {
-  if (!ecr) ecr = new AWS.ECR(awsConfig);
+  if (forImages) {
+    log.debug('logging into AWS ECR for images:', forImages);
+    const regions = new Set(forImages.flatMap(image => {
+      try {
+        return [parseECRImageUri(image).region];
+      } catch {
+        return [];
+      }
+    }));
+    log.debug('parsed AWS regions from images:', regions);
+    await Promise.all([...regions].map(async region => loginToECR({
+      awsConfig: {
+        ...awsConfig,
+        region
+      }
+    })));
+    return;
+  }
+  if (!ecr) ecr = new ECRClient({
+    ...awsConfig
+  });
+  log.debug('logging into ECR for region:', await ecr.config.region());
   const {
     authorizationData
-  } = await ecr.getAuthorizationToken().promise();
+  } = await ecr.send(new GetAuthorizationTokenCommand());
   const {
     authorizationToken,
     proxyEndpoint
   } = (authorizationData === null || authorizationData === void 0 ? void 0 : authorizationData[0]) || {};
+  log.debug('GetAuthorizationToken data:', {
+    authorizationToken,
+    proxyEndpoint
+  });
   if (!authorizationToken) {
     throw new Error('failed to get authorizationToken from ECR');
   }
@@ -23,10 +52,12 @@ export default async function loginToECR({
     throw new Error('failed to get proxyEndpoint from ECR');
   }
   // this is silly...
-  const decoded = new Buffer(base64.toByteArray(authorizationToken)).toString('utf8');
+  const decoded = Buffer.from(base64.toByteArray(authorizationToken)).toString('utf8');
   const [user, password] = decoded.split(/:/);
-  const child = spawn('docker', ['login', '-u', user, '--password-stdin', proxyEndpoint], {
-    stdio: 'pipe',
+  const dockerArgs = ['login', '-u', user, '--password-stdin', proxyEndpoint];
+  log.debug('running: docker', ...dockerArgs.map(arg => /^[-_a-z0-9]+$/i.test(arg) ? arg : `'${arg.replace(/'/g, `'\\'')}'`)}'`));
+  const child = spawn('docker', dockerArgs, {
+    stdio: ['pipe', 'pipe', 'inherit'],
     encoding: 'utf8'
   });
   if (!child.stdin) {
@@ -34,5 +65,12 @@ export default async function loginToECR({
   }
   child.stdin.write(password);
   child.stdin.end();
-  await child;
-}
+  await child.then(() => log.debug('ECR login succeeded'), error => {
+    if (error && typeof error === 'object') {
+      if ('code' in error) log.debug('docker login exited with code', error.code);
+      if ('signal' in error) log.debug('docker login was killed with signal', error.signal);
+    }
+    throw error;
+  });
+}
+//# sourceMappingURL=loginToECR.mjs.map

package/loginToECR.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginToECR.mjs","names":["spawn","base64","ECRClient","GetAuthorizationTokenCommand","parseECRImageUri","log4jcore","log","logger","loginToECR","ecr","forImages","awsConfig","debug","regions","Set","flatMap","image","region","Promise","all","map","config","authorizationData","send","authorizationToken","proxyEndpoint","Error","decoded","Buffer","from","toByteArray","toString","user","password","split","dockerArgs","arg","test","replace","child","stdio","encoding","stdin","write","end","then","error","code","signal"],"sources":["src/loginToECR.ts"],"sourcesContent":[null],"mappings":"AAAA;AACA;AACA;AACA,SAASA,KAAK,QAAQ,yBAAyB;AAC/C,OAAOC,MAAM,MAAM,WAAW;AAC9B,SACEC,SAAS,EAETC,4BAA4B,QACvB,qBAAqB;AAC5B,OAAOC,gBAAgB;AACvB,OAAO,KAAKC,SAAS,MAAM,WAAW;AAEtC,MAAMC,GAAG,GAAGD,SAAS,CAACE,MAAM,CAAC,mCAAmC,CAAC;AAEjE,eAAe,eAAeC,UAAUA,CAAC;EACvCC,GAAG;EACHC,SAAS;EACTC;AAKF,CAAC,EAAiB;EAChB,IAAID,SAAS,EAAE;IACbJ,GAAG,CAACM,KAAK,CAAC,kCAAkC,EAAEF,SAAS,CAAC;IACxD,MAAMG,OAAO,GAAG,IAAIC,GAAG,CACrBJ,SAAS,CAACK,OAAO,CAAEC,KAAK,IAAK;MAC3B,IAAI;QACF,OAAO,CAACZ,gBAAgB,CAACY,KAAK,CAAC,CAACC,MAAM,CAAC;MACzC,CAAC,CAAC,MAAM;QACN,OAAO,EAAE;MACX;IACF,CAAC,CACH,CAAC;IACDX,GAAG,CAACM,KAAK,CAAC,iCAAiC,EAAEC,OAAO,CAAC;IACrD,MAAMK,OAAO,CAACC,GAAG,CACf,CAAC,GAAGN,OAAO,CAAC,CAACO,GAAG,CAAC,MAAOH,MAAM,IAC5BT,UAAU,CAAC;MACTG,SAAS,EAAE;QAAE,GAAGA,SAAS;QAAEM;MAAO;IACpC,CAAC,CACH,CACF,CAAC;IACD;EACF;EACA,IAAI,CAACR,GAAG,EAAEA,GAAG,GAAG,IAAIP,SAAS,CAAC;IAAE,GAAGS;EAAU,CAAC,CAAC;EAE/CL,GAAG,CAACM,KAAK,CAAC,8BAA8B,EAAE,MAAMH,GAAG,CAACY,MAAM,CAACJ,MAAM,CAAC,CAAC,CAAC;EACpE,MAAM;IAAEK;EAAkB,CAAC,GAAG,MAAMb,GAAG,CAACc,IAAI,CAC1C,IAAIpB,4BAA4B,CAAC,CACnC,CAAC;EACD,MAAM;IAAEqB,kBAAkB;IAAEC;EAAc,CAAC,GAAG,CAAAH,iBAAiB,aAAjBA,iBAAiB,uBAAjBA,iBAAiB,CAAG,CAAC,CAAC,KAAI,CAAC,CAAC;EAC1EhB,GAAG,CAACM,KAAK,CAAC,6BAA6B,EAAE;IACvCY,kBAAkB;IAClBC;EACF,CAAC,CAAC;EACF,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAM,IAAIE,KAAK,CAAC,2CAA2C,CAAC;EAC9D;EACA,IAAI,CAACD,aAAa,EAAE;IAClB,MAAM,IAAIC,KAAK,CAAC,sCAAsC,CAAC;EACzD;EACA;EACA,MAAMC,OAAO,GAAGC,MAAM,CAACC,IAAI,CAAC5B,MAAM,CAAC6B,WAAW,CAACN,kBAAkB,CAAC,CAAC,CAACO,QAAQ,CAC1E,MACF,CAAC;EACD,MAAM,CAACC,IAAI,EAAEC,QAAQ,CAAC,GAAGN,OAAO,CAACO,KAAK,CAAC,GAAG,CAAC;EAC3C,MAAMC,UAAU,GAAG,CAAC,OAAO,EAAE,IAAI,EAAEH,IAAI,EAAE,kBAAkB,EAAEP,aAAa,CAAC;EAC3EnB,GAAG,CAACM,KAAK,CACP,iBAAiB,EACjB,GAAGuB,UAAU,CAACf,GAAG,CAAEgB,GAAG,IACpB,gBAAgB,CAACC,IAAI,CAACD,GAAG,CAAC,GAAGA,GAAG,GAAG,IAAIA,GAAG,CAACE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,GACtE,CACF,CAAC;EACD,MAAMC,KAAK,GAAGvC,KAAK,CAAC,QAAQ,EAAEmC,UAAU,EAAE;IACxCK,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;IAClCC,QAAQ,EAAE;EACZ,CAAC,CAAC;EACF,IAAI,CAACF,KAAK,CAACG,KAAK,EAAE;IAChB,MAAM,IAAIhB,KAAK,CAAC,oCAAoC,CAAC;EACvD;EACAa,KAAK,CAACG,KAAK,CAACC,KAAK,CAACV,QAAQ,CAAC;EAC3BM,KAAK,CAACG,KAAK,CAACE,GAAG,CAAC,CAAC;EACjB,MAAML,KAAK,CAACM,IAAI,CACd,MAAMvC,GAAG,CAACM,KAAK,CAAC,qBAAqB,CAAC,EACrCkC,KAAc,IAAK;IAClB,IAAIA,KAAK,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE;MACtC,IAAI,MAAM,IAAIA,KAAK,EACjBxC,GAAG,CAACM,KAAK,CAAC,+BAA+B,EAAEkC,KAAK,CAACC,IAAI,CAAC;MACxD,IAAI,QAAQ,IAAID,KAAK,EACnBxC,GAAG,CAACM,KAAK,CAAC,qCAAqC,EAAEkC,KAAK,CAACE,MAAM,CAAC;IAClE;IACA,MAAMF,KAAK;EACb,CACF,CAAC;AACH","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jcoreio/aws-ecr-utils",
-  "version": "1.3.1",
+  "version": "2.1.0",
   "description": "utilities for working with AWS Elastic Container Registry",
   "sideEffects": false,
   "repository": {
@@ -19,11 +19,13 @@
   },
   "homepage": "https://github.com/jcoreio/aws-ecr-utils#readme",
   "dependencies": {
-    "@babel/runtime": "^7.18.6",
-    "aws-sdk": "^2.1070.0",
+    "@aws-sdk/client-ecr": "^3.577.0",
+    "@aws-sdk/client-sts": "^3.577.0",
+    "@babel/runtime": "^7.26.0",
     "base64-js": "^1.5.1",
     "inquirer": "^8.2.6",
     "is-interactive": "^1.0.0",
+    "log4jcore": "^4.8.0",
     "promisify-child-process": "^4.1.1",
     "zod": "^3.22.4"
   },
@@ -32,13 +34,19 @@
   "types": "index.d.ts",
   "exports": {
     ".": {
-      "types": "./index.d.ts",
+      "types": {
+        "import": "./index.d.mts",
+        "default": "./index.d.ts"
+      },
       "require": "./index.js",
       "default": "./index.mjs"
     },
     "./package.json": "./package.json",
     "./*": {
-      "types": "./*.d.ts",
+      "types": {
+        "import": "./*.d.mts",
+        "default": "./*.d.ts"
+      },
       "require": "./*.js",
       "default": "./*.mjs"
     }
@@ -46,5 +54,8 @@
   "engines": {
     "node": ">=16"
   },
-  "packageManager": "pnpm@8.3.1"
+  "packageManager": "pnpm@10.6.5",
+  "@jcoreio/toolchain": {
+    "migratedVersion": "5.8.6"
+  }
 }

package/parseECRImageUri.d.mts

@@ -0,0 +1,7 @@
+export default function parseECRImageUri(imageUri: string): {
+  registryId: string;
+  region: string;
+  repositoryName: string;
+  imageTag: string;
+};
+//# sourceMappingURL=parseECRImageUri.d.mts.map

package/parseECRImageUri.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRImageUri.d.mts","names":["parseECRImageUri","imageUri","registryId","region","repositoryName","imageTag"],"sources":["src/parseECRImageUri.ts"],"sourcesContent":[null],"mappings":"AAAA,eAAc,SAAUA,gBAAgBA,CAACC,QAAQ,EAAE,MAAM,GAAG;EAC1DC,UAAU,EAAE,MAAM;EAClBC,MAAM,EAAE,MAAM;EACdC,cAAc,EAAE,MAAM;EACtBC,QAAQ,EAAE,MAAM;CACjB","ignoreList":[]}

package/parseECRImageUri.d.ts

@@ -1,7 +1,8 @@
-import AWS from 'aws-sdk';
-export default function parseECRImageUri(imageUri: string): {
-    registryId: AWS.ECR.RegistryId;
-    region: string;
-    repositoryName: AWS.ECR.RepositoryName;
-    imageTag: string;
+declare function parseECRImageUri(imageUri: string): {
+  registryId: string;
+  region: string;
+  repositoryName: string;
+  imageTag: string;
 };
+export = parseECRImageUri;
+//# sourceMappingURL=parseECRImageUri.d.ts.map

package/parseECRImageUri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRImageUri.d.ts","names":["parseECRImageUri","imageUri","registryId","region","repositoryName","imageTag"],"sources":["src/parseECRImageUri.ts"],"sourcesContent":[null],"mappings":"AAAc,iBAAUA,gBAAgBA,CAACC,QAAQ,EAAE,MAAM,GAAG;EAC1DC,UAAU,EAAE,MAAM;EAClBC,MAAM,EAAE,MAAM;EACdC,cAAc,EAAE,MAAM;EACtBC,QAAQ,EAAE,MAAM;CACjB;AAOA,SAAAL,gBAAA","ignoreList":[]}

package/parseECRImageUri.js

@@ -21,4 +21,5 @@ function parseECRImageUri(imageUri) {
     imageTag: imageTag
   };
 }
-module.exports = exports.default;
+module.exports = exports.default;
+//# sourceMappingURL=parseECRImageUri.js.map

package/parseECRImageUri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRImageUri.js","names":["parseECRImageUri","imageUri","match","exec","Error","concat","_match","_slicedToArray2","registryId","region","repositoryName","imageTag","module","exports","default"],"sources":["src/parseECRImageUri.ts"],"sourcesContent":[null],"mappings":";;;;;;;;AAAe,SAASA,gBAAgBA,CAACC,QAAgB,EAKvD;EACA,IAAMC,KAAK,GAAG,wDAAwD,CAACC,IAAI,CACzEF,QACF,CAAC;EACD,IAAI,CAACC,KAAK,EAAE,MAAM,IAAIE,KAAK,sBAAAC,MAAA,CAAsBJ,QAAQ,CAAE,CAAC;EAC5D,IAAAK,MAAA,OAAAC,eAAA,aAAyDL,KAAK;IAArDM,UAAU,GAAAF,MAAA;IAAEG,MAAM,GAAAH,MAAA;IAAEI,cAAc,GAAAJ,MAAA;IAAEK,QAAQ,GAAAL,MAAA;EACrD,OAAO;IAAEE,UAAU,EAAVA,UAAU;IAAEC,MAAM,EAANA,MAAM;IAAEC,cAAc,EAAdA,cAAc;IAAEC,QAAQ,EAARA;EAAS,CAAC;AACzD;AAACC,MAAA,CAAAC,OAAA,GAAAA,OAAA,CAAAC,OAAA","ignoreList":[]}

package/parseECRImageUri.mjs

@@ -8,4 +8,5 @@ export default function parseECRImageUri(imageUri) {
     repositoryName,
     imageTag
   };
-}
+}
+//# sourceMappingURL=parseECRImageUri.mjs.map

package/parseECRImageUri.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRImageUri.mjs","names":["parseECRImageUri","imageUri","match","exec","Error","registryId","region","repositoryName","imageTag"],"sources":["src/parseECRImageUri.ts"],"sourcesContent":[null],"mappings":"AAAA,eAAe,SAASA,gBAAgBA,CAACC,QAAgB,EAKvD;EACA,MAAMC,KAAK,GAAG,wDAAwD,CAACC,IAAI,CACzEF,QACF,CAAC;EACD,IAAI,CAACC,KAAK,EAAE,MAAM,IAAIE,KAAK,CAAC,qBAAqBH,QAAQ,EAAE,CAAC;EAC5D,MAAM,GAAGI,UAAU,EAAEC,MAAM,EAAEC,cAAc,EAAEC,QAAQ,CAAC,GAAGN,KAAK;EAC9D,OAAO;IAAEG,UAAU;IAAEC,MAAM;IAAEC,cAAc;IAAEC;EAAS,CAAC;AACzD","ignoreList":[]}

package/parseECRRepositoryHostname.d.mts

@@ -0,0 +1,6 @@
+export default function parseECRRepositoryHostname(hostname: string): {
+  registryId: string;
+  region: string;
+  repositoryName: string;
+};
+//# sourceMappingURL=parseECRRepositoryHostname.d.mts.map

package/parseECRRepositoryHostname.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRRepositoryHostname.d.mts","names":["parseECRRepositoryHostname","hostname","registryId","region","repositoryName"],"sources":["src/parseECRRepositoryHostname.ts"],"sourcesContent":[null],"mappings":"AAAA,eAAc,SAAUA,0BAA0BA,CAACC,QAAQ,EAAE,MAAM,GAAG;EACpEC,UAAU,EAAE,MAAM;EAClBC,MAAM,EAAE,MAAM;EACdC,cAAc,EAAE,MAAM;CACvB","ignoreList":[]}

package/parseECRRepositoryHostname.d.ts

@@ -1,6 +1,7 @@
-import AWS from 'aws-sdk';
-export default function parseECRRepositoryHostname(hostname: string): {
-    registryId: AWS.ECR.RegistryId;
-    region: string;
-    repositoryName: AWS.ECR.RepositoryName;
+declare function parseECRRepositoryHostname(hostname: string): {
+  registryId: string;
+  region: string;
+  repositoryName: string;
 };
+export = parseECRRepositoryHostname;
+//# sourceMappingURL=parseECRRepositoryHostname.d.ts.map

package/parseECRRepositoryHostname.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRRepositoryHostname.d.ts","names":["parseECRRepositoryHostname","hostname","registryId","region","repositoryName"],"sources":["src/parseECRRepositoryHostname.ts"],"sourcesContent":[null],"mappings":"AAAc,iBAAUA,0BAA0BA,CAACC,QAAQ,EAAE,MAAM,GAAG;EACpEC,UAAU,EAAE,MAAM;EAClBC,MAAM,EAAE,MAAM;EACdC,cAAc,EAAE,MAAM;CACvB;AAOA,SAAAJ,0BAAA","ignoreList":[]}

package/parseECRRepositoryHostname.js

@@ -19,4 +19,5 @@ function parseECRRepositoryHostname(hostname) {
     repositoryName: repositoryName
   };
 }
-module.exports = exports.default;
+module.exports = exports.default;
+//# sourceMappingURL=parseECRRepositoryHostname.js.map

package/parseECRRepositoryHostname.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRRepositoryHostname.js","names":["parseECRRepositoryHostname","hostname","match","exec","Error","concat","_match","_slicedToArray2","registryId","region","repositoryName","module","exports","default"],"sources":["src/parseECRRepositoryHostname.ts"],"sourcesContent":[null],"mappings":";;;;;;;;AAAe,SAASA,0BAA0BA,CAACC,QAAgB,EAIjE;EACA,IAAMC,KAAK,GAAG,sDAAsD,CAACC,IAAI,CACvEF,QACF,CAAC;EACD,IAAI,CAACC,KAAK,EAAE,MAAM,IAAIE,KAAK,qCAAAC,MAAA,CAAqCJ,QAAQ,CAAE,CAAC;EAC3E,IAAAK,MAAA,OAAAC,eAAA,aAA+CL,KAAK;IAA3CM,UAAU,GAAAF,MAAA;IAAEG,MAAM,GAAAH,MAAA;IAAEI,cAAc,GAAAJ,MAAA;EAC3C,OAAO;IAAEE,UAAU,EAAVA,UAAU;IAAEC,MAAM,EAANA,MAAM;IAAEC,cAAc,EAAdA;EAAe,CAAC;AAC/C;AAACC,MAAA,CAAAC,OAAA,GAAAA,OAAA,CAAAC,OAAA","ignoreList":[]}

package/parseECRRepositoryHostname.mjs

@@ -7,4 +7,5 @@ export default function parseECRRepositoryHostname(hostname) {
     region,
     repositoryName
   };
-}
+}
+//# sourceMappingURL=parseECRRepositoryHostname.mjs.map

package/parseECRRepositoryHostname.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRRepositoryHostname.mjs","names":["parseECRRepositoryHostname","hostname","match","exec","Error","registryId","region","repositoryName"],"sources":["src/parseECRRepositoryHostname.ts"],"sourcesContent":[null],"mappings":"AAAA,eAAe,SAASA,0BAA0BA,CAACC,QAAgB,EAIjE;EACA,MAAMC,KAAK,GAAG,sDAAsD,CAACC,IAAI,CACvEF,QACF,CAAC;EACD,IAAI,CAACC,KAAK,EAAE,MAAM,IAAIE,KAAK,CAAC,oCAAoCH,QAAQ,EAAE,CAAC;EAC3E,MAAM,GAAGI,UAAU,EAAEC,MAAM,EAAEC,cAAc,CAAC,GAAGL,KAAK;EACpD,OAAO;IAAEG,UAAU;IAAEC,MAAM;IAAEC;EAAe,CAAC;AAC/C","ignoreList":[]}

package/src/ImageManifestSchema.ts

@@ -0,0 +1,19 @@
+import z from 'zod'
+
+const MediaType = z.string().min(1)
+const Size = z.number().int().nonnegative()
+const Digest = z.string().min(32)
+
+const LayerSchema = z.object({
+  mediaType: MediaType,
+  size: Size,
+  digest: Digest,
+})
+
+export const ImageManifestSchema = z.object({
+  schemaVersion: z.literal(2),
+  mediaType: z.string(),
+  config: LayerSchema,
+  layers: z.array(LayerSchema),
+})
+export type ImageManifestSchema = z.infer<typeof ImageManifestSchema>

package/src/checkECRImageAccess.ts

@@ -0,0 +1,193 @@
+import {
+  BatchCheckLayerAvailabilityCommand,
+  BatchGetImageCommand,
+  ECRClient,
+  ECRClientConfig,
+  GetDownloadUrlForLayerCommand,
+  GetRepositoryPolicyCommand,
+  SetRepositoryPolicyCommand,
+} from '@aws-sdk/client-ecr'
+import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts'
+import parseECRImageUri from './parseECRImageUri'
+import { ImageManifestSchema } from './ImageManifestSchema'
+import isInteractive from 'is-interactive'
+import inquirer from 'inquirer'
+import formatECRRepositoryHostname from './formatECRRepositoryHostname'
+
+export default async function checkECRImageAccess({
+  ecr,
+  awsConfig,
+  repoAccountAwsConfig,
+  imageUri,
+  log = console,
+}: {
+  ecr?: ECRClient
+  awsConfig?: ECRClientConfig
+  /**
+   * Config for the AWS account containing the ECR repository.
+   * Optional; if given, will prompt to add/update the policy on the
+   * ECR repository, if access checks failed and the terminal is
+   * interactive.
+   */
+  repoAccountAwsConfig?: ECRClientConfig
+  imageUri: string
+  log?: {
+    info: (...args: any[]) => void
+    warn: (...args: any[]) => void
+    error: (...args: any[]) => void
+  }
+}): Promise<boolean> {
+  log.error('checking access to ECR image:', imageUri, '...')
+
+  const { registryId, region, repositoryName, imageTag } =
+    parseECRImageUri(imageUri)
+  if (!ecr) ecr = new ECRClient({ ...awsConfig, region })
+
+  try {
+    const { images = [] } = await ecr.send(
+      new BatchGetImageCommand({
+        registryId,
+        repositoryName,
+        imageIds: [{ imageTag }],
+      })
+    )
+
+    const imageManifest = images[0]?.imageManifest
+
+    if (!imageManifest) {
+      throw new Error(`imageManifest not found for: ${imageUri}`)
+    }
+    const { config, layers } = ImageManifestSchema.parse(
+      JSON.parse(imageManifest)
+    )
+
+    await ecr.send(
+      new BatchCheckLayerAvailabilityCommand({
+        registryId,
+        repositoryName,
+        layerDigests: [config.digest, ...layers.map((l) => l.digest)],
+      })
+    )
+
+    await ecr.send(
+      new GetDownloadUrlForLayerCommand({
+        registryId,
+        repositoryName,
+        layerDigest: layers[0].digest,
+      })
+    )
+
+    log.error(`ECR image is accessible: ${imageUri}`)
+    return true
+  } catch (error) {
+    if (!(error instanceof Error) || error.name !== 'AccessDeniedException') {
+      throw error
+    }
+  }
+  log.error(`Unable to access ECR image: ${imageUri}`)
+
+  const Action = [
+    'ecr:GetDownloadUrlForLayer',
+    'ecr:BatchCheckLayerAvailability',
+    'ecr:BatchGetImage',
+  ]
+
+  log.error(`You may need to add a policy to the ECR repository to allow this account.
+
+The policy should include:
+
+  ${JSON.stringify(
+    {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Effect: 'Allow',
+          Principal: {
+            AWS: ['XXXXXXXXXXXX'],
+          },
+          Action,
+        },
+      ],
+    },
+    null,
+    2
+  ).replace(/\n/gm, '\n  ')}
+`)
+
+  if (repoAccountAwsConfig && isInteractive()) {
+    const { Account } = await new STSClient({
+      credentials: ecr.config.credentials,
+      region,
+    }).send(new GetCallerIdentityCommand())
+    if (!Account) {
+      log.error(`failed to determine AWS account`)
+      return false
+    }
+
+    const { update } = await inquirer.prompt([
+      {
+        name: 'update',
+        message: 'Do you want to add/update the policy?',
+        type: 'confirm',
+        default: false,
+      },
+    ])
+    if (!update) return false
+
+    const srcEcr = new ECRClient({
+      ...repoAccountAwsConfig,
+      region,
+    })
+    const { policyText } = await srcEcr
+      .send(
+        new GetRepositoryPolicyCommand({
+          registryId,
+          repositoryName,
+        })
+      )
+      .catch((error: unknown): { policyText?: string } => {
+        if (
+          error &&
+          typeof error === 'object' &&
+          'name' in error &&
+          error.name === 'RepositoryPolicyNotFoundException'
+        )
+          return {}
+        throw error
+      })
+
+    const policy: any = JSON.parse(policyText || '{}')
+    await srcEcr.send(
+      new SetRepositoryPolicyCommand({
+        repositoryName,
+        policyText: JSON.stringify(
+          {
+            Version: '2012-10-17',
+            ...policy,
+            Statement: [
+              ...(policy.Statement || []),
+              {
+                Effect: 'Allow',
+                Principal: {
+                  AWS: [Account],
+                },
+                Action,
+              },
+            ],
+          },
+          null,
+          2
+        ),
+      })
+    )
+    log.info(
+      `updated policy on ECR repository ${formatECRRepositoryHostname({
+        registryId,
+        region,
+        repositoryName,
+      })}`
+    )
+    return await checkECRImageAccess({ awsConfig, imageUri, log, ecr })
+  }
+  return false
+}

package/src/checkECRRepositoryPolicy.ts

@@ -0,0 +1,153 @@
+import {
+  ECRClient,
+  ECRClientConfig,
+  GetRepositoryPolicyCommand,
+  SetRepositoryPolicyCommand,
+} from '@aws-sdk/client-ecr'
+import inquirer from 'inquirer'
+import isInteractive from 'is-interactive'
+
+/**
+ * Checks if the given ECR repository has a sufficient repository
+ * policy to allow the given AWS principal to access docker images.
+ *
+ * If not, prints a warning, and if the terminal is interactive, asks the user if they
+ * would like to add/update the repository policy.
+ */
+export default async function checkECRRepositoryPolicy({
+  ecr,
+  awsConfig,
+  repositoryName,
+  awsPrincipal,
+  Action = [
+    'ecr:GetDownloadUrlForLayer',
+    'ecr:BatchCheckLayerAvailability',
+    'ecr:BatchGetImage',
+  ],
+  log = console,
+}: {
+  ecr?: ECRClient
+  awsConfig?: ECRClientConfig
+  repositoryName: string
+  awsPrincipal: string
+  Action?: string[]
+  log?: {
+    info: (...args: any[]) => void
+    warn: (...args: any[]) => void
+    error: (...args: any[]) => void
+  }
+}): Promise<boolean> {
+  const rootUserMatch = /^arn:aws:iam::(\d+):root$/.exec(awsPrincipal)
+  if (rootUserMatch) awsPrincipal = rootUserMatch[1]
+
+  const principalAliases =
+    /^(\d+)$/.test(awsPrincipal) ?
+      [awsPrincipal, `arn:aws:iam::${awsPrincipal}:root`]
+    : [awsPrincipal]
+
+  if (!ecr) ecr = new ECRClient({ ...awsConfig })
+  const { policyText } = await ecr
+    .send(new GetRepositoryPolicyCommand({ repositoryName }))
+    .catch((error: unknown): { policyText?: string } => {
+      if (
+        error &&
+        typeof error === 'object' &&
+        'name' in error &&
+        error.name === 'RepositoryPolicyNotFoundException'
+      )
+        return {}
+      throw error
+    })
+  const policy: any = JSON.parse(policyText || '{}')
+  const statementForAction = policy.Statement?.find(
+    (s: any) =>
+      s.Effect === 'Allow' &&
+      Array.isArray(Action) &&
+      Action.every((a) => s.Action?.includes(a))
+  )
+  const statementPrincipal = statementForAction?.Principal?.AWS
+
+  if (
+    (statementPrincipal &&
+      typeof statementPrincipal === 'string' &&
+      principalAliases.includes(statementPrincipal)) ||
+    (Array.isArray(statementPrincipal) &&
+      statementPrincipal.some((s) => principalAliases.includes(s)))
+  ) {
+    log.info(
+      `Found policy on ECR repository ${repositoryName} to allow access for AWS Principal ${awsPrincipal}.`
+    )
+    return true
+  }
+
+  // eslint-disable-next-line no-console
+  console.warn(`Missing policy on ECR repository ${repositoryName} to allow access for AWS Principal ${awsPrincipal}.
+
+The policy should include:
+
+  ${JSON.stringify(
+    {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Effect: 'Allow',
+          Principal: {
+            AWS: [awsPrincipal],
+          },
+          Action,
+        },
+      ],
+    },
+    null,
+    2
+  ).replace(/\n/gm, '\n  ')}
+`)
+  if (isInteractive()) {
+    const { update } = await inquirer.prompt([
+      {
+        name: 'update',
+        message: 'Do you want to add/update the policy?',
+        type: 'confirm',
+        default: false,
+      },
+    ])
+    if (update) {
+      let finalPolicy = policy
+      if (statementForAction?.Action?.length === Action.length) {
+        statementForAction.Principal = {
+          ...statementForAction.Principal,
+          AWS: [
+            ...(typeof statementPrincipal === 'string' ? [statementPrincipal]
+            : Array.isArray(statementPrincipal) ? statementPrincipal
+            : []),
+            awsPrincipal,
+          ],
+        }
+      } else {
+        finalPolicy = {
+          Version: '2012-10-17',
+          ...policy,
+          Statement: [
+            ...(policy.Statement || []),
+            {
+              Effect: 'Allow',
+              Principal: {
+                AWS: [awsPrincipal],
+              },
+              Action,
+            },
+          ],
+        }
+      }
+      await ecr.send(
+        new SetRepositoryPolicyCommand({
+          repositoryName,
+          policyText: JSON.stringify(finalPolicy, null, 2),
+        })
+      )
+      log.info(`updated policy on ECR repository ${repositoryName}`)
+      return true
+    }
+  }
+  return false
+}