Amazon Elastic Container Registry (ECR)¶

Amazon Elastic Container Registry (ECR) is a managed container registry for storing, sharing, and deploying container images and artifacts.

Prerequisite Tasks¶

To use these operators, you must do a few things:

Create necessary resources using AWS Console or AWS CLI.
Install API libraries via pip.
pip install 'apache-airflow[amazon]'
Detailed information is available Installation of Airflow®
Setup Connection.

Generic Parameters¶

aws_conn_id

Reference to Amazon Web Services Connection ID. If this parameter is set to None then the default boto3 behaviour is used without a connection lookup. Otherwise use the credentials stored in the Connection. Default: aws_default

region_name

AWS Region Name. If this parameter is set to None or omitted then region_name from AWS Connection Extra Parameter will be used. Otherwise use the specified value instead of the connection value. Default: None

verify

Whether or not to verify SSL certificates.

False - Do not validate SSL certificates.
path/to/cert/bundle.pem - A filename of the CA cert bundle to use. You can specify this argument if you want to use a different CA cert bundle than the one used by botocore.

If this parameter is set to None or is omitted then verify from AWS Connection Extra Parameter will be used. Otherwise use the specified value instead of the connection value. Default: None

botocore_config

The provided dictionary is used to construct a botocore.config.Config. This configuration can be used to configure Avoid Throttling exceptions, timeouts, etc.

Example, for more detail about parameters please have a look botocore.config.Config¶

{
    "signature_version": "unsigned",
    "s3": {
        "us_east_1_regional_endpoint": True,
    },
    "retries": {
      "mode": "standard",
      "max_attempts": 10,
    },
    "connect_timeout": 300,
    "read_timeout": 300,
    "tcp_keepalive": True,
}

If this parameter is set to None or omitted then config_kwargs from AWS Connection Extra Parameter will be used. Otherwise use the specified value instead of the connection value. Default: None

Note

Specifying an empty dictionary, {}, will overwrite the connection configuration for botocore.config.Config

Operators¶

Create an ECR repository¶

To create an ECR repository, use EcrCreateRepositoryOperator. This operator can provision a repository before a workflow builds or pushes container images. The operator returns the complete response from the Boto3 create_repository API operation.

tests/system/amazon/aws/example_ecr.py[source]

create_repository = EcrCreateRepositoryOperator(
    task_id="create_repository",
    repository_name=repository_name,
)

Set an ECR repository policy¶

To set the repository policy for an ECR repository, use EcrSetRepositoryPolicyOperator. This operator can configure permissions such as cross-account access to images stored in the repository. The operator returns the complete response from the Boto3 set_repository_policy API operation.

tests/system/amazon/aws/example_ecr.py[source]

set_repository_policy = EcrSetRepositoryPolicyOperator(
    task_id="set_repository_policy",
    repository_name=repository_name,
    policy_text="""
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowAccountPull",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::{{ task_instance.xcom_pull(task_ids='create_repository')['repository']['registryId'] }}:root"
          },
          "Action": [
            "ecr:BatchGetImage",
            "ecr:GetDownloadUrlForLayer"
          ]
        }
      ]
    }
    """,
)

Delete an ECR repository¶

To delete an ECR repository, use EcrDeleteRepositoryOperator. This operator can clean up temporary repositories or repositories that are no longer needed. Set force=True to delete a repository that contains images. The operator returns the complete response from the Boto3 delete_repository API operation.

tests/system/amazon/aws/example_ecr.py[source]

delete_repository = EcrDeleteRepositoryOperator(
    task_id="delete_repository",
    repository_name=repository_name,
    force=True,
    trigger_rule=TriggerRule.ALL_DONE,
)

Reference¶

AWS Boto3 library documentation for ECR