we are creating ecr repository using terraform. i created repos using for each. i am trying to attach policy. i am unable to use repo in resource - foreach

Question

we are creating ecr repository using terraform. i created repos using for each. i am trying to attach policy. i am unable to use repo in resource
tfvars file
app_ecr_repo = [
{ name = "project-1" },
{ name = "project-2" }
]
using for each we are taking two repo names
module "ecr" {
source = "../../modules/ecr"
# Common
default_tags = var.default_tags
# ECR
for_each = { for repos in var.app_ecr_repo : join("-", [repos.name]) => repos }
ecr_respositories = [
{
repo_name = each.value.name
lifecycle_policy_file = "ecr_policy_01_tagged.json"
image_tag_mutability = "IMMUTABLE"
image_scanning_enabled = true
}
]
}
how to attach ecr repository name here
resource "aws_ecr_repository_policy" "repo_policy" {
repository = module.ecr.name
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "new policy",
"Effect": "Allow",
"Principal": "*",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability",
"ecr:PutImage",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload",
"ecr:DescribeRepositories",
"ecr:GetRepositoryPolicy",
"ecr:ListImages",
"ecr:DeleteRepository",
"ecr:BatchDeleteImage",
"ecr:SetRepositoryPolicy",
"ecr:DeleteRepositoryPolicy"
]
}
]
}
EOF
}
This is root module. He we passed resources for aws_ecr_repository
############################################################################################################
Elastic Container Registry (ECR)
############################################################################################################
resource "aws_ecr_repository" "this" {
count = length(var.ecr_respositories) > 0 ? length(var.ecr_respositories) : 0
name = lookup(var.ecr_respositories[count.index], "repo_name", null)
image_tag_mutability = lookup(var.ecr_respositories[count.index], "image_tag_mutability", var.image_tag_mutability)
image_scanning_configuration {
scan_on_push = lookup(var.ecr_respositories[count.index], "image_scanning_enabled", var.image_scanning_enabled)
}
tags = merge(
{
"Name" = lookup(var.ecr_respositories[count.index], "repo_name", null)
},
var.tags,
var.default_tags
)
}
############################################################################################################
# ECR Lifecycle Policy
############################################################################################################
locals {
ecr_respositories_with_policy = [
for repo in var.ecr_respositories :
repo
if lookup(repo, "lifecycle_policy_file", null) != null
]
}
resource "aws_ecr_lifecycle_policy" "this" {
count = length(local.ecr_respositories_with_policy) > 0 ? length(local.ecr_respositories_with_policy) : 0
policy = file("${path.cwd}/ecr_lifecycle_policy/${local.ecr_respositories_with_policy[count.index].lifecycle_policy_file}")
repository = local.ecr_respositories_with_policy[count.index].repo_name
depends_on = [aws_ecr_repository.this]
}

Answer 1

In order to be able to access the attributes of the resources created using modules, the child module has to have an output defined [1]. Accessing the child module output [2] is a bit different compared to outputs defined without using modules. So, in the child module code, you would have to add the following:
output "ecr_name" {
description = "ECR repository name."
value = aws_ecr_repository.this.name
}
Since the module was invoked by using the for_each meta-argument, in the policy, you would say something like:
resource "aws_ecr_repository_policy" "repo_policy" {
for_each = { for repos in var.app_ecr_repo : join("-", [repos.name]) => repos }
repository = module.ecr[each.key].ecr_name
.
.
.
}
Referring to module instances is described in [3].
EDIT
The child module is using the count meta-argument and the root module is using for_each meta-argument. Because of that, it is hard to map between the output of the module and the input required in the aws_ecr_repository_policy resource and make it dynamic. The only way this could work is:
a) Hardcoding the value of the key for the resource created with the module, e.g., repository = module.ecr["project-1"].ecr_name[count.index], along with the count meta-argument set to count = length(module.ecr["project-1"].ecr_name). This would have to be repeated for project-2.
b) Hardcoding the value of the index for the output and using the same for_each, i.e., for_each = { for repos in var.app_ecr_repo : join("-", [repos.name]) => repos } and the repository = module.ecr[each.key].ecr_name[0]
The second case is a bit better, but only because in the module call currently a list with one element gets passed:
ecr_respositories = [
{
repo_name = each.value.name
image_tag_mutability = "IMMUTABLE"
image_scanning_enabled = true
}
]
If the number of elements would be increased, the solution would not work and there would have to be multiple instances of aws_ecr_repository_policy resource. Additionally, the resource could be added to the module itself which could help avoiding these headaches.
Solution 1
In the root module, add this:
resource "aws_ecr_repository_policy" "repo_policy" {
for_each = { for repos in var.app_ecr_repo : join("-", [repos.name]) => repos }
repository = module.ecr[each.key].ecr_name[0]
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "new policy",
"Effect": "Allow",
"Principal": "*",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability",
"ecr:PutImage",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload",
"ecr:DescribeRepositories",
"ecr:GetRepositoryPolicy",
"ecr:ListImages",
"ecr:DeleteRepository",
"ecr:BatchDeleteImage",
"ecr:SetRepositoryPolicy",
"ecr:DeleteRepositoryPolicy"
]
}
]
}
EOF
}
Solution 2
In the child module, add the following code:
resource "aws_ecr_repository_policy" "repo_policy" {
count = length(var.ecr_respositories) > 0 ? length(var.ecr_respositories) : 0
repository = aws_ecr_repository.this[count.index].name
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "new policy",
"Effect": "Allow",
"Principal": "*",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability",
"ecr:PutImage",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload",
"ecr:DescribeRepositories",
"ecr:GetRepositoryPolicy",
"ecr:ListImages",
"ecr:DeleteRepository",
"ecr:BatchDeleteImage",
"ecr:SetRepositoryPolicy",
"ecr:DeleteRepositoryPolicy"
]
}
]
}
EOF
}
[1] https://www.terraform.io/language/values/outputs#declaring-an-output-value
[2] https://www.terraform.io/language/values/outputs#accessing-child-module-outputs
[3] https://www.terraform.io/language/meta-arguments/for_each#referring-to-instances