1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetAuthorizationToken"
      ],
      "Resource": "*"
    }
  ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

{
  "rules": [
    {
      "rulePriority": integer,
      "description": "string",
      "selection": {
        "tagStatus": "tagged"|"untagged"|"any",
        "tagPatternList": list<string>,
        "tagPrefixList": list<string>,
        "storageClass": "standard"|"archive",
        "countType": "imageCountMoreThan"|"sinceImagePushed"|"sinceImagePulled"|"sinceImageTransitioned",
        "countUnit": "string",
        "countNumber": integer
      },
      "action": {
        "type": "expire"|"transition",
        "targetStorageClass": "archive"
      }
    }
  ]
} 

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

locals {
  # 자격증명들
  cache_creds = {
    docker-hub = {
      username    = var.dockerhub_username
      accessToken = var.dockerhub_access_token
    }
    ghcr = {
      username    = var.ghcr_username
      accessToken = var.ghcr_access_token
    }
  }
  
  # Pull through cache rule들 정보를 map형태로
  pull_through_cache_rules = {
    k8s = {
      upstream_registry_url = "registry.k8s.io"
      needs_auth            = false
    }
    ecr-public = {
      upstream_registry_url = "public.ecr.aws"
      needs_auth            = false
    }
    quay = {
      upstream_registry_url = "quay.io"
      needs_auth            = false
    }
    ghcr = {
      upstream_registry_url = "ghcr.io"
      needs_auth            = true
    }
    docker-hub = {
      upstream_registry_url = "registry-1.docker.io"
      needs_auth            = true
    }
  }
}

## ECR Caches for external registries

# 시크릿
# 기본 KMS(AWS Managed Key) 사용중
# 필요시 CMK(Customer Managed Key) 사용가능
resource "aws_secretsmanager_secret" "cache_cred" {
  for_each    = local.cache_creds
  name        = "ecr-pullthroughcache/${each.key}"
  description = "Credentials for ECP pull through cache: ${each.key}"
}

# 시크릿 정보 저장
# 주의: secret_version을 이용한 이러한 방법은 tfstate에 시크릿 정보가 저장될 수 있음
# 그래서 시크릿 데이터 자체는 IaC를 이용하지 않는 경우도 있음
resource "aws_secretsmanager_secret_version" "cache_cred" {
  for_each  = local.cache_creds
  secret_id = aws_secretsmanager_secret.cache_cred[each.key].id
  secret_string = jsonencode({
    username    = each.value.username
    accessToken = each.value.accessToken
  })
}

# Pull through cache rule
# locals에있는 레지스트리정보들마다 생성
# Template의 prefix와 맞춤
resource "aws_ecr_pull_through_cache_rule" "cache" {
  for_each = local.pull_through_cache_rules

  ecr_repository_prefix = each.key
  upstream_registry_url = each.value.upstream_registry_url

  credential_arn = each.value.needs_auth ? aws_secretsmanager_secret.cache_cred[each.key].arn : null
}

# Template
# Pull through cache에서 생성됨
# 태그는 IMMUTABLE
# prefix는 pull_through_cache_rule의 prefix와 맞춤
resource "aws_ecr_repository_creation_template" "cache_template" {
  for_each = local.pull_through_cache_rules

  prefix = each.key

  description          = "Template for cache registries"
  image_tag_mutability = "IMMUTABLE"

  applied_for = [
    "PULL_THROUGH_CACHE",
  ]

  # 기본암호화. 필요하다면 KMS + CMK암호화로 컴플라이언스 준수 가능.
  encryption_configuration {
    encryption_type = "AES256"
  }

  # 생명주기 정책
  # 1. tagged 이미지: 마지막으로 pull된지 14일이 지나면 정리
  # 2. Untagged 이미지: push된지 5일 지나면 정리
  lifecycle_policy = jsonencode({
    rules = [
      {
        rulePriority = 1
        description  = "Expire tagged images older than 14 days"
        selection = {
          tagStatus   = "tagged"
          countType   = "sinceImagePulled"
          countUnit   = "days"
          countNumber = 14
        }
        action = {
          type = "expire"
        }
      },
      {
        rulePriority = 2
        description  = "Expire untagged images older than 5 days"
        selection = {
          tagStatus   = "untagged"
          countType   = "sinceImagePushed"
          countUnit   = "days"
          countNumber = 5
        }
        action = {
          type = "expire"
        }
      }
    ]
  })
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# 엔드포인트 타입에 따라 필요한 인자가 달라질 수 있음
resource "aws_vpc_endpoint" "this" {
  for_each = var.endpoints

  vpc_id            = var.vpc_id
  service_name      = each.value.service_name
  vpc_endpoint_type = each.value.endpoint_type

  private_dns_enabled = each.value.endpoint_type == "Interface" ? try(each.value.private_dns_enabled, true) : null
  subnet_ids          = each.value.endpoint_type == "Interface" ? try(each.value.subnet_ids, null) : null
  security_group_ids  = each.value.endpoint_type == "Interface" ? try(each.value.security_group_ids, null) : null
  route_table_ids     = each.value.endpoint_type == "Gateway" ? try(each.value.route_table_ids, null) : null

  policy          = try(each.value.policy, null)
  ip_address_type = try(each.value.ip_address_type, null)

  tags = merge(
    var.tags,
    try(each.value.tags, {}),
    {
      Name = each.key
    }
  )
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

variable "vpc_id" {
  description = "VPC ID"
  type        = string
}

variable "tags" {
  description = "Global Tags for endpoints"
  type        = map(string)
  default     = {}
}

variable "endpoints" {
  description = "Endpoint Informations"
  type = map(object({
    service_name        = string
    endpoint_type       = string
    private_dns_enabled = optional(bool)
    subnet_ids          = optional(list(string), [])
    security_group_ids  = optional(list(string), [])
    route_table_ids     = optional(list(string), [])
    policy              = optional(string)
    ip_address_type     = optional(string)
    tags                = optional(map(string), {})
  }))
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

# VPC Endpoints

# 보안그룹 생성
resource "aws_security_group" "vpce" {
  vpc_id      = module.vpc.vpc_id
  name        = "allow-private-subnets"
  description = "Allow traffic from private subnets"
}

# ingress 룰 생성
resource "aws_vpc_security_group_ingress_rule" "allow_vpc" {
  security_group_id = aws_security_group.vpce.id

  cidr_ipv4   = var.vpc_cidr
  ip_protocol = "tcp"
  from_port   = 443
  to_port     = 443
}

module "vpc-endpoints" {
  source = "../../modules/vpc-endpoint" # 모듈 파일 참조 주의
  vpc_id = module.vpc.vpc_id 
  endpoints = {
    ec2 = {
      service_name        = "com.amazonaws.ap-northeast-2.ec2"
      endpoint_type       = "Interface"
      private_dns_enabled = true
      subnet_ids          = module.vpc.private_subnet_ids
      security_group_ids  = [aws_security_group.vpce.id]
    }
    ecr_api = {
      service_name        = "com.amazonaws.ap-northeast-2.ecr.api"
      endpoint_type       = "Interface"
      private_dns_enabled = true
      subnet_ids          = module.vpc.private_subnet_ids
      security_group_ids  = [aws_security_group.vpce.id]
    }
    ecr_dkr = {
      service_name        = "com.amazonaws.ap-northeast-2.ecr.dkr"
      endpoint_type       = "Interface"
      private_dns_enabled = true
      subnet_ids          = module.vpc.private_subnet_ids
      security_group_ids  = [aws_security_group.vpce.id]
    }
    s3 = {
      service_name    = "com.amazonaws.ap-northeast-2.s3"
      endpoint_type   = "Gateway"
      route_table_ids = [module.vpc.private_route_table_id]
    }
    cloudwatch_logs = {
      service_name        = "com.amazonaws.ap-northeast-2.logs"
      endpoint_type       = "Interface"
      private_dns_enabled = true
      subnet_ids          = module.vpc.private_subnet_ids
      security_group_ids  = [aws_security_group.vpce.id]
    }
    sts = {
      service_name        = "com.amazonaws.ap-northeast-2.sts"
      endpoint_type       = "Interface"
      private_dns_enabled = true
      subnet_ids          = module.vpc.private_subnet_ids
      security_group_ids  = [aws_security_group.vpce.id]
    }
    eks_auth = {
      service_name        = "com.amazonaws.ap-northeast-2.eks-auth"
      endpoint_type       = "Interface"
      private_dns_enabled = true
      subnet_ids          = module.vpc.private_subnet_ids
      security_group_ids  = [aws_security_group.vpce.id]
    }
    eks = {
      service_name        = "com.amazonaws.ap-northeast-2.eks"
      endpoint_type       = "Interface"
      private_dns_enabled = true
      subnet_ids          = module.vpc.private_subnet_ids
      security_group_ids  = [aws_security_group.vpce.id]
    }
  }
}