@jcoreio/aws-ecr-utils 2.0.0 → 2.1.1

package/parseECRImageUri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRImageUri.js","names":["parseECRImageUri","imageUri","match","exec","Error","concat","_match","_slicedToArray2","registryId","region","repositoryName","imageTag","module","exports","default"],"sources":["src/parseECRImageUri.ts"],"sourcesContent":[null],"mappings":";;;;;;;;AAAe,SAASA,gBAAgBA,CAACC,QAAgB,EAKvD;EACA,IAAMC,KAAK,GAAG,wDAAwD,CAACC,IAAI,CACzEF,QACF,CAAC;EACD,IAAI,CAACC,KAAK,EAAE,MAAM,IAAIE,KAAK,sBAAAC,MAAA,CAAsBJ,QAAQ,CAAE,CAAC;EAC5D,IAAAK,MAAA,OAAAC,eAAA,aAAyDL,KAAK;IAArDM,UAAU,GAAAF,MAAA;IAAEG,MAAM,GAAAH,MAAA;IAAEI,cAAc,GAAAJ,MAAA;IAAEK,QAAQ,GAAAL,MAAA;EACrD,OAAO;IAAEE,UAAU,EAAVA,UAAU;IAAEC,MAAM,EAANA,MAAM;IAAEC,cAAc,EAAdA,cAAc;IAAEC,QAAQ,EAARA;EAAS,CAAC;AACzD;AAACC,MAAA,CAAAC,OAAA,GAAAA,OAAA,CAAAC,OAAA","ignoreList":[]}

package/parseECRImageUri.mjs

@@ -8,4 +8,5 @@ export default function parseECRImageUri(imageUri) {
     repositoryName,
     imageTag
   };
-}
+}
+//# sourceMappingURL=parseECRImageUri.mjs.map

package/parseECRImageUri.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRImageUri.mjs","names":["parseECRImageUri","imageUri","match","exec","Error","registryId","region","repositoryName","imageTag"],"sources":["src/parseECRImageUri.ts"],"sourcesContent":[null],"mappings":"AAAA,eAAe,SAASA,gBAAgBA,CAACC,QAAgB,EAKvD;EACA,MAAMC,KAAK,GAAG,wDAAwD,CAACC,IAAI,CACzEF,QACF,CAAC;EACD,IAAI,CAACC,KAAK,EAAE,MAAM,IAAIE,KAAK,CAAC,qBAAqBH,QAAQ,EAAE,CAAC;EAC5D,MAAM,GAAGI,UAAU,EAAEC,MAAM,EAAEC,cAAc,EAAEC,QAAQ,CAAC,GAAGN,KAAK;EAC9D,OAAO;IAAEG,UAAU;IAAEC,MAAM;IAAEC,cAAc;IAAEC;EAAS,CAAC;AACzD","ignoreList":[]}

package/parseECRRepositoryHostname.d.mts

@@ -0,0 +1,6 @@
+export default function parseECRRepositoryHostname(hostname: string): {
+  registryId: string;
+  region: string;
+  repositoryName: string;
+};
+//# sourceMappingURL=parseECRRepositoryHostname.d.mts.map

package/parseECRRepositoryHostname.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRRepositoryHostname.d.mts","names":["parseECRRepositoryHostname","hostname","registryId","region","repositoryName"],"sources":["src/parseECRRepositoryHostname.ts"],"sourcesContent":[null],"mappings":"AAAA,eAAc,SAAUA,0BAA0BA,CAACC,QAAQ,EAAE,MAAM,GAAG;EACpEC,UAAU,EAAE,MAAM;EAClBC,MAAM,EAAE,MAAM;EACdC,cAAc,EAAE,MAAM;CACvB","ignoreList":[]}

package/parseECRRepositoryHostname.d.ts

@@ -1,5 +1,7 @@
-export default function parseECRRepositoryHostname(hostname: string): {
-    registryId: string;
-    region: string;
-    repositoryName: string;
+declare function parseECRRepositoryHostname(hostname: string): {
+  registryId: string;
+  region: string;
+  repositoryName: string;
 };
+export = parseECRRepositoryHostname;
+//# sourceMappingURL=parseECRRepositoryHostname.d.ts.map

package/parseECRRepositoryHostname.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRRepositoryHostname.d.ts","names":["parseECRRepositoryHostname","hostname","registryId","region","repositoryName"],"sources":["src/parseECRRepositoryHostname.ts"],"sourcesContent":[null],"mappings":"AAAc,iBAAUA,0BAA0BA,CAACC,QAAQ,EAAE,MAAM,GAAG;EACpEC,UAAU,EAAE,MAAM;EAClBC,MAAM,EAAE,MAAM;EACdC,cAAc,EAAE,MAAM;CACvB;AAOA,SAAAJ,0BAAA","ignoreList":[]}

package/parseECRRepositoryHostname.js

@@ -19,4 +19,5 @@ function parseECRRepositoryHostname(hostname) {
     repositoryName: repositoryName
   };
 }
-module.exports = exports.default;
+module.exports = exports.default;
+//# sourceMappingURL=parseECRRepositoryHostname.js.map

package/parseECRRepositoryHostname.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRRepositoryHostname.js","names":["parseECRRepositoryHostname","hostname","match","exec","Error","concat","_match","_slicedToArray2","registryId","region","repositoryName","module","exports","default"],"sources":["src/parseECRRepositoryHostname.ts"],"sourcesContent":[null],"mappings":";;;;;;;;AAAe,SAASA,0BAA0BA,CAACC,QAAgB,EAIjE;EACA,IAAMC,KAAK,GAAG,sDAAsD,CAACC,IAAI,CACvEF,QACF,CAAC;EACD,IAAI,CAACC,KAAK,EAAE,MAAM,IAAIE,KAAK,qCAAAC,MAAA,CAAqCJ,QAAQ,CAAE,CAAC;EAC3E,IAAAK,MAAA,OAAAC,eAAA,aAA+CL,KAAK;IAA3CM,UAAU,GAAAF,MAAA;IAAEG,MAAM,GAAAH,MAAA;IAAEI,cAAc,GAAAJ,MAAA;EAC3C,OAAO;IAAEE,UAAU,EAAVA,UAAU;IAAEC,MAAM,EAANA,MAAM;IAAEC,cAAc,EAAdA;EAAe,CAAC;AAC/C;AAACC,MAAA,CAAAC,OAAA,GAAAA,OAAA,CAAAC,OAAA","ignoreList":[]}

package/parseECRRepositoryHostname.mjs

@@ -7,4 +7,5 @@ export default function parseECRRepositoryHostname(hostname) {
     region,
     repositoryName
   };
-}
+}
+//# sourceMappingURL=parseECRRepositoryHostname.mjs.map

package/parseECRRepositoryHostname.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseECRRepositoryHostname.mjs","names":["parseECRRepositoryHostname","hostname","match","exec","Error","registryId","region","repositoryName"],"sources":["src/parseECRRepositoryHostname.ts"],"sourcesContent":[null],"mappings":"AAAA,eAAe,SAASA,0BAA0BA,CAACC,QAAgB,EAIjE;EACA,MAAMC,KAAK,GAAG,sDAAsD,CAACC,IAAI,CACvEF,QACF,CAAC;EACD,IAAI,CAACC,KAAK,EAAE,MAAM,IAAIE,KAAK,CAAC,oCAAoCH,QAAQ,EAAE,CAAC;EAC3E,MAAM,GAAGI,UAAU,EAAEC,MAAM,EAAEC,cAAc,CAAC,GAAGL,KAAK;EACpD,OAAO;IAAEG,UAAU;IAAEC,MAAM;IAAEC;EAAe,CAAC;AAC/C","ignoreList":[]}

package/src/ImageManifestSchema.ts

@@ -0,0 +1,19 @@
+import z from 'zod'
+
+const MediaType = z.string().min(1)
+const Size = z.number().int().nonnegative()
+const Digest = z.string().min(32)
+
+const LayerSchema = z.object({
+  mediaType: MediaType,
+  size: Size,
+  digest: Digest,
+})
+
+export const ImageManifestSchema = z.object({
+  schemaVersion: z.literal(2),
+  mediaType: z.string(),
+  config: LayerSchema,
+  layers: z.array(LayerSchema),
+})
+export type ImageManifestSchema = z.infer<typeof ImageManifestSchema>

package/src/checkECRImageAccess.ts

@@ -0,0 +1,193 @@
+import {
+  BatchCheckLayerAvailabilityCommand,
+  BatchGetImageCommand,
+  ECRClient,
+  type ECRClientConfig,
+  GetDownloadUrlForLayerCommand,
+  GetRepositoryPolicyCommand,
+  SetRepositoryPolicyCommand,
+} from '@aws-sdk/client-ecr'
+import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts'
+import parseECRImageUri from './parseECRImageUri.ts'
+import { ImageManifestSchema } from './ImageManifestSchema.ts'
+import { isInteractive } from './isInteractive.ts'
+import inquirer from 'inquirer'
+import formatECRRepositoryHostname from './formatECRRepositoryHostname.ts'
+
+export default async function checkECRImageAccess({
+  ecr,
+  awsConfig,
+  repoAccountAwsConfig,
+  imageUri,
+  log = console,
+}: {
+  ecr?: ECRClient
+  awsConfig?: ECRClientConfig
+  /**
+   * Config for the AWS account containing the ECR repository.
+   * Optional; if given, will prompt to add/update the policy on the
+   * ECR repository, if access checks failed and the terminal is
+   * interactive.
+   */
+  repoAccountAwsConfig?: ECRClientConfig
+  imageUri: string
+  log?: {
+    info: (...args: any[]) => void
+    warn: (...args: any[]) => void
+    error: (...args: any[]) => void
+  }
+}): Promise<boolean> {
+  log.error('checking access to ECR image:', imageUri, '....ts')
+
+  const { registryId, region, repositoryName, imageTag } =
+    parseECRImageUri(imageUri)
+  if (!ecr) ecr = new ECRClient({ ...awsConfig, region })
+
+  try {
+    const { images = [] } = await ecr.send(
+      new BatchGetImageCommand({
+        registryId,
+        repositoryName,
+        imageIds: [{ imageTag }],
+      })
+    )
+
+    const imageManifest = images[0]?.imageManifest
+
+    if (!imageManifest) {
+      throw new Error(`imageManifest not found for: ${imageUri}`)
+    }
+    const { config, layers } = ImageManifestSchema.parse(
+      JSON.parse(imageManifest)
+    )
+
+    await ecr.send(
+      new BatchCheckLayerAvailabilityCommand({
+        registryId,
+        repositoryName,
+        layerDigests: [config.digest, ...layers.map((l) => l.digest)],
+      })
+    )
+
+    await ecr.send(
+      new GetDownloadUrlForLayerCommand({
+        registryId,
+        repositoryName,
+        layerDigest: layers[0].digest,
+      })
+    )
+
+    log.error(`ECR image is accessible: ${imageUri}`)
+    return true
+  } catch (error) {
+    if (!(error instanceof Error) || error.name !== 'AccessDeniedException') {
+      throw error
+    }
+  }
+  log.error(`Unable to access ECR image: ${imageUri}`)
+
+  const Action = [
+    'ecr:GetDownloadUrlForLayer',
+    'ecr:BatchCheckLayerAvailability',
+    'ecr:BatchGetImage',
+  ]
+
+  log.error(`You may need to add a policy to the ECR repository to allow this account.
+
+The policy should include:
+
+  ${JSON.stringify(
+    {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Effect: 'Allow',
+          Principal: {
+            AWS: ['XXXXXXXXXXXX'],
+          },
+          Action,
+        },
+      ],
+    },
+    null,
+    2
+  ).replace(/\n/gm, '\n  ')}
+`)
+
+  if (repoAccountAwsConfig && isInteractive) {
+    const { Account } = await new STSClient({
+      credentials: ecr.config.credentials,
+      region,
+    }).send(new GetCallerIdentityCommand())
+    if (!Account) {
+      log.error(`failed to determine AWS account`)
+      return false
+    }
+
+    const { update } = await inquirer.prompt([
+      {
+        name: 'update',
+        message: 'Do you want to add/update the policy?',
+        type: 'confirm',
+        default: false,
+      },
+    ])
+    if (!update) return false
+
+    const srcEcr = new ECRClient({
+      ...repoAccountAwsConfig,
+      region,
+    })
+    const { policyText } = await srcEcr
+      .send(
+        new GetRepositoryPolicyCommand({
+          registryId,
+          repositoryName,
+        })
+      )
+      .catch((error: unknown): { policyText?: string } => {
+        if (
+          error &&
+          typeof error === 'object' &&
+          'name' in error &&
+          error.name === 'RepositoryPolicyNotFoundException'
+        )
+          return {}
+        throw error
+      })
+
+    const policy: any = JSON.parse(policyText || '{}')
+    await srcEcr.send(
+      new SetRepositoryPolicyCommand({
+        repositoryName,
+        policyText: JSON.stringify(
+          {
+            Version: '2012-10-17',
+            ...policy,
+            Statement: [
+              ...(policy.Statement || []),
+              {
+                Effect: 'Allow',
+                Principal: {
+                  AWS: [Account],
+                },
+                Action,
+              },
+            ],
+          },
+          null,
+          2
+        ),
+      })
+    )
+    log.info(
+      `updated policy on ECR repository ${formatECRRepositoryHostname({
+        registryId,
+        region,
+        repositoryName,
+      })}`
+    )
+    return await checkECRImageAccess({ awsConfig, imageUri, log, ecr })
+  }
+  return false
+}

package/src/checkECRRepositoryPolicy.ts

@@ -0,0 +1,153 @@
+import {
+  ECRClient,
+  type ECRClientConfig,
+  GetRepositoryPolicyCommand,
+  SetRepositoryPolicyCommand,
+} from '@aws-sdk/client-ecr'
+import inquirer from 'inquirer'
+import { isInteractive } from './isInteractive.ts'
+
+/**
+ * Checks if the given ECR repository has a sufficient repository
+ * policy to allow the given AWS principal to access docker images.
+ *
+ * If not, prints a warning, and if the terminal is interactive, asks the user if they
+ * would like to add/update the repository policy.
+ */
+export default async function checkECRRepositoryPolicy({
+  ecr,
+  awsConfig,
+  repositoryName,
+  awsPrincipal,
+  Action = [
+    'ecr:GetDownloadUrlForLayer',
+    'ecr:BatchCheckLayerAvailability',
+    'ecr:BatchGetImage',
+  ],
+  log = console,
+}: {
+  ecr?: ECRClient
+  awsConfig?: ECRClientConfig
+  repositoryName: string
+  awsPrincipal: string
+  Action?: string[]
+  log?: {
+    info: (...args: any[]) => void
+    warn: (...args: any[]) => void
+    error: (...args: any[]) => void
+  }
+}): Promise<boolean> {
+  const rootUserMatch = /^arn:aws:iam::(\d+):root$/.exec(awsPrincipal)
+  if (rootUserMatch) awsPrincipal = rootUserMatch[1]
+
+  const principalAliases =
+    /^(\d+)$/.test(awsPrincipal) ?
+      [awsPrincipal, `arn:aws:iam::${awsPrincipal}:root`]
+    : [awsPrincipal]
+
+  if (!ecr) ecr = new ECRClient({ ...awsConfig })
+  const { policyText } = await ecr
+    .send(new GetRepositoryPolicyCommand({ repositoryName }))
+    .catch((error: unknown): { policyText?: string } => {
+      if (
+        error &&
+        typeof error === 'object' &&
+        'name' in error &&
+        error.name === 'RepositoryPolicyNotFoundException'
+      )
+        return {}
+      throw error
+    })
+  const policy: any = JSON.parse(policyText || '{}')
+  const statementForAction = policy.Statement?.find(
+    (s: any) =>
+      s.Effect === 'Allow' &&
+      Array.isArray(Action) &&
+      Action.every((a) => s.Action?.includes(a))
+  )
+  const statementPrincipal = statementForAction?.Principal?.AWS
+
+  if (
+    (statementPrincipal &&
+      typeof statementPrincipal === 'string' &&
+      principalAliases.includes(statementPrincipal)) ||
+    (Array.isArray(statementPrincipal) &&
+      statementPrincipal.some((s) => principalAliases.includes(s)))
+  ) {
+    log.info(
+      `Found policy on ECR repository ${repositoryName} to allow access for AWS Principal ${awsPrincipal}.`
+    )
+    return true
+  }
+
+  // eslint-disable-next-line no-console
+  console.warn(`Missing policy on ECR repository ${repositoryName} to allow access for AWS Principal ${awsPrincipal}.
+
+The policy should include:
+
+  ${JSON.stringify(
+    {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Effect: 'Allow',
+          Principal: {
+            AWS: [awsPrincipal],
+          },
+          Action,
+        },
+      ],
+    },
+    null,
+    2
+  ).replace(/\n/gm, '\n  ')}
+`)
+  if (isInteractive) {
+    const { update } = await inquirer.prompt([
+      {
+        name: 'update',
+        message: 'Do you want to add/update the policy?',
+        type: 'confirm',
+        default: false,
+      },
+    ])
+    if (update) {
+      let finalPolicy = policy
+      if (statementForAction?.Action?.length === Action.length) {
+        statementForAction.Principal = {
+          ...statementForAction.Principal,
+          AWS: [
+            ...(typeof statementPrincipal === 'string' ? [statementPrincipal]
+            : Array.isArray(statementPrincipal) ? statementPrincipal
+            : []),
+            awsPrincipal,
+          ],
+        }
+      } else {
+        finalPolicy = {
+          Version: '2012-10-17',
+          ...policy,
+          Statement: [
+            ...(policy.Statement || []),
+            {
+              Effect: 'Allow',
+              Principal: {
+                AWS: [awsPrincipal],
+              },
+              Action,
+            },
+          ],
+        }
+      }
+      await ecr.send(
+        new SetRepositoryPolicyCommand({
+          repositoryName,
+          policyText: JSON.stringify(finalPolicy, null, 2),
+        })
+      )
+      log.info(`updated policy on ECR repository ${repositoryName}`)
+      return true
+    }
+  }
+  return false
+}

package/src/copyECRImage.ts

@@ -0,0 +1,76 @@
+import { spawn } from 'promisify-child-process'
+import loginToECR from './loginToECR.ts'
+import ecrImageExists from './ecrImageExists.ts'
+import parseECRImageUri from './parseECRImageUri.ts'
+import { ECRClient, type ECRClientConfig } from '@aws-sdk/client-ecr'
+
+export default async function copyECRImage({
+  from,
+  to,
+}: {
+  from: {
+    imageUri: string
+    ecr?: ECRClient
+    awsConfig?: ECRClientConfig
+  }
+  to: {
+    imageUri: string
+    ecr?: ECRClient
+    awsConfig?: ECRClientConfig
+  }
+}): Promise<void> {
+  if (from.imageUri === to.imageUri) return
+  const srcRepositoryUri = from.imageUri.replace(/:.+/, '')
+  const repositoryUri = to.imageUri.replace(/:.+/, '')
+
+  const { region: fromRegion } = parseECRImageUri(from.imageUri)
+  const {
+    region: toRegion,
+    repositoryName,
+    imageTag,
+  } = parseECRImageUri(to.imageUri)
+
+  if (
+    await ecrImageExists({
+      awsConfig: { ...to.awsConfig, region: toRegion },
+      ecr: to.ecr,
+      repositoryName,
+      imageTag,
+    })
+  ) {
+    // eslint-disable-next-line no-console
+    console.error(
+      `Clarity image already exists in your ECR: ${repositoryName}:${imageTag}`
+    )
+  } else {
+    // eslint-disable-next-line no-console
+    console.error(
+      `Logging into source ECR: ${srcRepositoryUri.replace(/\/.*/, '')}...`
+    )
+
+    await loginToECR({
+      ecr: from.ecr,
+      awsConfig: { ...from.awsConfig, region: fromRegion },
+    })
+
+    // eslint-disable-next-line no-console
+    console.error(`Pulling ${from.imageUri}...`)
+    await spawn('docker', ['pull', from.imageUri], { stdio: 'inherit' })
+
+    // eslint-disable-next-line no-console
+    console.error(
+      `Logging into dest ECR: ${repositoryUri.replace(/\/.*/, '')}...`
+    )
+    await loginToECR({
+      ecr: to.ecr,
+      awsConfig: { ...to.awsConfig, region: toRegion },
+    })
+
+    // eslint-disable-next-line no-console
+    console.error(`Pushing ${to.imageUri}...`)
+    await spawn('docker', ['tag', from.imageUri, to.imageUri], {
+      stdio: 'inherit',
+    })
+    await spawn('docker', ['push', to.imageUri], { stdio: 'inherit' })
+  }
+}

package/src/ecrImageExists.ts

@@ -0,0 +1,48 @@
+import {
+  DescribeImagesCommand,
+  ECRClient,
+  type ECRClientConfig,
+} from '@aws-sdk/client-ecr'
+
+export default async function ecrImageExists({
+  ecr,
+  awsConfig,
+  imageUri,
+  registryId,
+  repositoryName,
+  imageTag,
+}: {
+  ecr?: ECRClient
+  awsConfig?: ECRClientConfig
+  imageUri?: string
+  registryId?: string
+  repositoryName?: string
+  imageTag?: string
+}): Promise<boolean> {
+  let region
+  if (imageUri) {
+    const match = /(\d+)\.dkr\.ecr\.(.+?)\.amazonaws\.com\/(.+?):(.+)/.exec(
+      imageUri
+    )
+    if (!match) throw new Error(`failed to parse imageUri: ${imageUri}`)
+    ;[, registryId, region, repositoryName, imageTag] = match
+  }
+  if (!region) region = awsConfig?.region
+  if (!ecr) ecr = new ECRClient({ ...awsConfig, region })
+
+  if (!repositoryName || !imageTag) {
+    throw new Error(`missing repositoryName/imageTag or imageUri`)
+  }
+  return await ecr
+    .send(
+      new DescribeImagesCommand({
+        registryId,
+        repositoryName,
+        imageIds: [{ imageTag }],
+      })
+    )
+    .then(
+      () => true,
+      () => false
+    )
+}

package/src/formatECRImageUri.ts

@@ -0,0 +1,19 @@
+import formatECRRepositoryHostname from './formatECRRepositoryHostname.ts'
+
+export default function formatECRImageUri({
+  registryId,
+  region,
+  repositoryName,
+  imageTag,
+}: {
+  registryId: string
+  region: string
+  repositoryName: string
+  imageTag: string
+}): string {
+  return `${formatECRRepositoryHostname({
+    registryId,
+    region,
+    repositoryName,
+  })}:${imageTag}`
+}

package/src/formatECRRepositoryHostname.ts

@@ -0,0 +1,11 @@
+export default function formatECRRepositoryHostname({
+  registryId,
+  region,
+  repositoryName,
+}: {
+  registryId: string
+  region: string
+  repositoryName: string
+}): string {
+  return `${registryId}.dkr.ecr.${region}.amazonaws.com/${repositoryName}`
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+export { default as copyECRImage } from './copyECRImage.ts'
+export { default as ecrImageExists } from './ecrImageExists.ts'
+export { default as loginToECR } from './loginToECR.ts'
+export { default as tagECRImage } from './tagECRImage.ts'
+export { default as parseECRImageUri } from './parseECRImageUri.ts'
+export { default as parseECRRepositoryHostname } from './parseECRRepositoryHostname.ts'
+export { default as upsertECRRepository } from './upsertECRRepository.ts'
+export { default as checkECRRepositoryPolicy } from './checkECRRepositoryPolicy.ts'
+export { default as checkECRImageAccess } from './checkECRImageAccess.ts'
+export { default as formatECRRepositoryHostname } from './formatECRRepositoryHostname.ts'
+export { default as formatECRImageUri } from './formatECRImageUri.ts'

package/src/isInteractive.ts

@@ -0,0 +1,2 @@
+export const isInteractive =
+  process.stdout.isTTY && process.env.TERM !== 'dumb' && !('CI' in process.env)