(aws-ecr): Expose repository domain or hostname

[moltar]

Describe the feature

Expose the repository domain/hostname as a prop.

Use Case

The Docker credentials helper (e.g. docker-credential-ecr-login) expects a hostname in the configuration.

{
	"credHelpers": {
		"public.ecr.aws": "ecr-login",
		"<aws_account_id>.dkr.ecr.<region>.amazonaws.com": "ecr-login"
	}
}

Docs: https://github.com/awslabs/amazon-ecr-credential-helper?tab=readme-ov-file#docker

Proposed Solution

Extract the hostname part from this method:

aws-cdk/packages/aws-cdk-lib/aws-ecr/lib/repository.ts

Lines 234 to 242 in 0c753c3

	/**
	* Returns the repository URI, with an appended suffix, if provided.
	* @param suffix An image tag or an image digest.
	* @private
	*/
	private repositoryUriWithSuffix(suffix?: string): string {
	const parts = this.stack.splitArn(this.repositoryArn, ArnFormat.SLASH_RESOURCE_NAME);
	return `${parts.account}.dkr.ecr.${parts.region}.${this.stack.urlSuffix}/${this.repositoryName}${suffix}`;
	}

And make it public:

  /**
   * Returns the domain of the repository. Can be used in Docker credentials helper.
   *
   *    ACCOUNT.dkr.ecr.REGION.amazonaws.com
   *
   * @param tagOrDigest Optional image tag or digest (digests must start with `sha256:`)
   */
  public get repositoryDomain(): string {
    return "";
  }

Other Information

This helper already ships with some CodeBuild images:

aws/aws-codebuild-docker-images#743

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.x

Environment details (OS name and version, etc.)

N/A

[ashishdhingra]

If we examine Push commands for an ECR repository, the 1st step is to Retrieve an authentication token and authenticate your Docker client to your registry. Use the AWS CLI:

aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin <<ACCOUNT>>.dkr.ecr.<<REGION>>.amazonaws.com`

So it is useful to expose a property, let's say registryUri, in IRepository interface (similar to repositoryUri):

  /**
   * The URI of this repository's registry:
   *
   *    ACCOUNT.dkr.ecr.REGION.amazonaws.com
   *
   * @attribute
   */
  readonly registryUri: string;

Then introduce property below in RepositoryBase class:

  /**
   * The URI of this repository's registry:
   *
   *    ACCOUNT.dkr.ecr.REGION.amazonaws.com
   *
   */
  public get registryUri() {
    const parts = this.stack.splitArn(this.repositoryArn, ArnFormat.SLASH_RESOURCE_NAME);
    return `${parts.account}.dkr.ecr.${parts.region}.${this.stack.urlSuffix}`;
  }

[moltar]

@ashishdhingra Good point. Luckily, that command seems to work with the full repositoryUri value, too!

[moltar]

Altho I'd be careful with the registryUri nomenclature, as URI implies that there must be a scheme. What we have is truly just a domain or a hostname. But if we forget the implementation detail, it might just be a name. 🤷🏼

https://en.wikipedia.org/wiki/Uniform_Resource_Identifier

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.