Add a life cycle rule to the repository.

Life cycle rules automatically expire images from the repository that match
certain conditions.

addLifecycleRule

Add a policy statement to the repository's resource policy.

While other resources policies in AWS either require or accept a resource section,
Cfn for ECR does not allow us to specify a resource policy.
It will fail if a resource section is present at all.

addToResourcePolicy

Repository

Whether all images should be automatically deleted when the repository is removed from the stack or when the stack is deleted.

Requires the `removalPolicy` to be set to `RemovalPolicy.DESTROY`.

autoDeleteImages

If true, deleting the repository force deletes the contents of the repository.

If false, the repository must be empty before attempting to delete it.

emptyOnDelete

The kind of server-side encryption to apply to this repository.

If you choose KMS, you can specify a KMS key via `encryptionKey`. If
encryptionKey is not specified, an AWS managed KMS key is used.

encryption

External KMS key to use for repository encryption.

The 'encryption' property must be either not specified or set to "KMS".
An error will be emitted if encryption is set to "AES256".

encryptionKey

Enable the scan on push when creating the repository.

imageScanOnPush

The tag mutability setting for the repository.

If this parameter is omitted, the default setting of MUTABLE will be used which will allow image tags to be overwritten.

imageTagMutability

The image tag mutability exclusion filters for the repository.

These filters specify which image tags can override the repository's default image tag mutability setting.

imageTagMutabilityExclusionFilters

The AWS account ID associated with the registry that contains the repository.

lifecycleRegistryId

Life cycle rules to apply to this registry.

lifecycleRules

Determine what happens to the repository when the resource/stack is deleted.

removalPolicy

Name for this repository.

The repository name must start with a letter and can only contain lowercase letters, numbers, hyphens, underscores, and forward slashes.

> If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.

repositoryName

The `AWS::ECR::PublicRepository` resource specifies an Amazon Elastic Container Registry Public (Amazon ECR Public) repository, where users can push and pull Docker images, Open Container Initiative (OCI) images, and OCI compatible artifacts.

For more information, see [Amazon ECR public repositories](https://docs.aws.amazon.com/AmazonECR/latest/public/public-repositories.html) in the *Amazon ECR Public User Guide* .

CfnPublicRepository

The details about the repository that are publicly visible in the Amazon ECR Public Gallery.

For more information, see [Amazon ECR Public repository catalog data](https://docs.aws.amazon.com/AmazonECR/latest/public/public-repository-catalog-data.html) in the *Amazon ECR Public User Guide* .

repositoryCatalogData

The name to use for the public repository.

The repository name may be specified on its own (such as `nginx-web-app` ) or it can be prepended with a namespace to group the repository into a category (such as `project-a/nginx-web-app` ). If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the repository name. For more information, see [Name Type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) .

> If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.

The JSON repository policy text to apply to the public repository.

For more information, see [Amazon ECR Public repository policies](https://docs.aws.amazon.com/AmazonECR/latest/public/public-repository-policies.html) in the *Amazon ECR Public User Guide* .

repositoryPolicyText

An array of key-value pairs to apply to this resource.

CfnPullThroughCacheRule

The ARN of the Secrets Manager secret associated with the pull through cache rule.

credentialArn

The ARN of the IAM role associated with the pull through cache rule.

customRoleArn

The Amazon ECR repository prefix associated with the pull through cache rule.

ecrRepositoryPrefix

The name of the upstream source registry associated with the pull through cache rule.

upstreamRegistry

The upstream registry URL associated with the pull through cache rule.

upstreamRegistryUrl

The upstream repository prefix associated with the pull through cache rule.

upstreamRepositoryPrefix

The ARN of the IAM principal to remove from the pull time update exclusion list.

CfnPullTimeUpdateExclusion

principalArn

The `AWS::ECR::RegistryPolicy` resource creates or updates the permissions policy for a private registry.

A private registry policy is used to specify permissions for another AWS account and is used when configuring cross-account replication. For more information, see [Registry permissions](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry-permissions.html) in the *Amazon Elastic Container Registry User Guide* .

CfnRegistryPolicy

policyText

The scanning configuration for a private registry.

CfnRegistryScanningConfiguration

The scanning rules associated with the registry.

rules

The type of scanning configured for the registry.

scanType

The `AWS::ECR::ReplicationConfiguration` resource creates or updates the replication configuration for a private registry.

The first time a replication configuration is applied to a private registry, a service-linked IAM role is created in your account for the replication process. For more information, see [Using Service-Linked Roles for Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/using-service-linked-roles.html) in the *Amazon Elastic Container Registry User Guide* .

> When configuring cross-account replication, the destination account must grant the source account permission to replicate. This permission is controlled using a private registry permissions policy. For more information, see `AWS::ECR::RegistryPolicy` .

CfnReplicationConfiguration

The replication configuration for a registry.

replicationConfiguration

The `AWS::ECR::Repository` resource specifies an Amazon Elastic Container Registry (Amazon ECR) repository, where users can push and pull Docker images, Open Container Initiative (OCI) images, and OCI compatible artifacts.

For more information, see [Amazon ECR private repositories](https://docs.aws.amazon.com/AmazonECR/latest/userguide/Repositories.html) in the *Amazon ECR User Guide* .

CfnRepository

The encryption configuration for the repository.

This determines how the contents of your repository are encrypted at rest.

encryptionConfiguration

> The `imageScanningConfiguration` parameter is being deprecated, in favor of specifying the image scanning configuration at the registry level.

For more information, see `PutRegistryScanningConfiguration` .

The image scanning configuration for the repository. This determines whether images are scanned for known vulnerabilities after being pushed to the repository.

imageScanningConfiguration

The tag mutability setting for the repository.

If this parameter is omitted, the default setting of `MUTABLE` will be used which will allow image tags to be overwritten. If `IMMUTABLE` is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.

A list of filters that specify which image tags are excluded from the repository's image tag mutability setting.

Creates or updates a lifecycle policy.

For information about lifecycle policy syntax, see [Lifecycle policy template](https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html) .

lifecyclePolicy

The name to use for the repository.

The repository name may be specified on its own (such as `nginx-web-app` ) or it can be prepended with a namespace to group the repository into a category (such as `project-a/nginx-web-app` ). If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the repository name. For more information, see [Name type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) .

The repository name must start with a letter and can only contain lowercase letters, numbers, hyphens, underscores, and forward slashes.

> If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.

The JSON repository policy text to apply to the repository.

For more information, see [Amazon ECR repository policies](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html) in the *Amazon Elastic Container Registry User Guide* .

The details of the repository creation template associated with the request.

CfnRepositoryCreationTemplate

A list of enumerable Strings representing the repository creation scenarios that this template will apply towards.

The supported scenarios are PULL_THROUGH_CACHE, REPLICATION, and CREATE_ON_PUSH

appliedFor

The repository namespace prefix associated with the repository creation template.

prefix

The ARN of the role to be assumed by Amazon ECR.

Amazon ECR will assume your supplied role when the customRoleArn is specified. When this field isn't specified, Amazon ECR will use the service-linked role for the repository creation template.

The description associated with the repository creation template.

description

The encryption configuration associated with the repository creation template.

A list of filters that specify which image tags are excluded from the repository creation template's image tag mutability setting.

The lifecycle policy to use for repositories created using the template.

The repository policy to apply to repositories created using the template.

A repository policy is a permissions policy associated with a repository to control access permissions.

repositoryPolicy

The metadata to apply to the repository to help you categorize and organize.

Each tag consists of a key and an optional value, both of which you define. Tag keys can have a maximum character length of 128 characters, and tag values can have a maximum length of 256 characters.

resourceTags

The signing configuration for a registry, which specifies rules for automatically signing images when pushed.

CfnSigningConfiguration

A list of signing rules.

Each rule defines a signing profile and optional repository filters that determine which images are automatically signed.

Amazon ECR

L2 Constructs1

Repository

L1 Constructs9

CfnPublicRepository

CfnPullThroughCacheRule

CfnPullTimeUpdateExclusion

CfnRegistryPolicy

CfnRegistryScanningConfiguration

CfnReplicationConfiguration

CfnRepository

CfnRepositoryCreationTemplate

CfnSigningConfiguration

Learn AWS the Practical Way

Quick Facts

Related Links

More Amazon ECR deep dives