Upgrade to Pro — share decks privately, control downloads, hide ads and more …

테라폼으로 ECR 관리하기 (How to Manage ECR with Terraform)

테라폼으로 ECR 관리하기 (How to Manage ECR with Terraform)

AWS의 관리형 컨테이너 이미지 저장소 서비스인 ECR을 테라폼으로 관리해온 경험을 공유합니다.

Byungjin Park

July 12, 2022
Tweet

More Decks by Byungjin Park

Other Decks in Programming

Transcript

  1. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬਵ۽ ECR ҙܻೞӝ


    How to Manage AWS ECR with Terraform
    ߅ ߽૓ (Byungjin Park) · ௿۽٘ (Claud) · Site Reliability Engineer @ ׼Ӕಕ੉
    AWS KRUG Container
    Jul 12, 2022

    View full-size slide

  2. speaker
    ߊ಴੗ ࣗѐ
    Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ߅߽૓ / @posquit0 / ௿۽٘ (Claud)
    (അ) Site Reliability Engineer @ ׼Ӕಕ੉


    (੹) Director of Infrastructure Division @ ஠ࢎ௏ܻই


    (੹) Software Architect @ ১פযझ

    (੹) Co-founder & Software Engineer @ ஠೒ۖ
    HashiCorp Ambassador / AWS Community Builder

    Ҵઁ೧ఊ؀ഥ DEFCON CTF ࠄࢶ 6ഥ ૓୹


    ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐ ਍৔


    ೠҴ੄ য়೑ࣗझ ઺ GitHub 15,000ѐ ੉࢚੄ झఋܳ ߉਷ ೐۽ં౟

    View full-size slide

  3. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Agenda
    intro
    AWS ECR 101
    Terraform Modules for AWS ECR
    AWS ECR ࢲ࠺झ੄ ӝࠄ੸ੋ ղਊী ؀೧ ࢓ಝࠇפ׮.
    AWS ECRਸ ബਯ੸ਵ۽ ҙܻೞӝ ਤೠ పۄಬ ݽٕਸ ݅ٚ җ੿ী ؀೧ ҕਬ೤פ׮.
    Terraform Workspace for AWS ECR
    పۄಬ ਕ௼झಕ੉झ ࢚ীࢲ पઁ۽ AWS ECRਸ ҙܻೞח ߑߨਸ ҕਬ೤פ׮.
    Extra for AWS ECR
    AWS ECRҗ ా೤ؼ ࣻ ੓ח ׮ܲ AWS ࢲ࠺झܳ рױೞѱ ࢓ಝࠇפ׮.

    View full-size slide

  4. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    AWS ECR 101

    View full-size slide

  5. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ECR (Elastic Container Registry)
    AWS ECR 101
    ECR਷ AWS ജ҃ীࢲ ੷࠺ਊਵ۽ औҊ উ੿੸ਵ۽ ੉ਊೡ ࣻ ੓ח ஶప੉ց ੉޷૑ ੷੢ࣗ ࢲ࠺झੑפ׮.
    ؘ੉ఠ ੷੢ ࠺ਊ ߂ ֎౟ਕ௼ ࣠न ࠺ਊ݅ ࠗҗ
    AWSীࢲ ઁҕೞח ҙܻഋ ஶప੉ց ੉޷૑ ੷੢ࣗ ࢲ࠺झ

    View full-size slide

  6. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ઱ਃ ҳࢿਃࣗ
    ECR਷ ೐ۄ੉ࡁ ੷੢ࣗ৬ ಌ࠶ܼ ੷੢ࣗܳ ઁҕ೤פ׮.
    Private Registry
    Private Repository
    Public Registry
    Container Image
    Container Image
    Container Image
    Container Image
    Private Repository
    Public Repository
    Public Repository
    AWS ECR 101

    View full-size slide

  7. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ઱ਃ ҳࢿਃࣗ
    ੉ߣ दрীח ೐ۄ੉ࡁ ੉޷૑ ੷੢ࣗী ؀೧ࢲ݅ ׮ܛפ׮. 😁
    Private Registry
    Private Repository
    Public Registry
    Container Image
    Container Image
    Container Image
    Container Image
    Private Repository
    Public Repository
    Public Repository
    AWS ECR 101

    View full-size slide

  8. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ECR Private Registry
    AWS ҅੿੄ п ܻ੹ ױਤ۽ ஶప੉ց ੉޷૑ ੷੢ࣗ ਍৔


    ೞա੄ ۨ૑झ౟ܻח ৈ۞ ੉޷૑ ۨನ૑షܻ ҙܻ
    ૑৉ ࢲ࠺झ (Regional Service)
    ੉޷૑ ੷੢ࣗ р ࠂઁ (Replication) — Cross Regions / Cross Accounts


    ੉޷૑ ࠙ࢳਸ ాೠ ࠁউ ஂড੼ Ѩࢎ (Scanning)


    ಽ झܖ நद (Pull-through Cache)


    ׮নೠ ࠗо ӝמ ઁҕ
    ࢎਊ੗ח ۨ૑झ౟ܻী ؀ೠ ࣁࠗ ࢸ੿݅ ߸҃ೡ ࣻ ੓णפ׮.
    ECR ೐ۄ੉ࡁ ۨ૑झ౟ܻח AWS ҅੿੄ п ܻ੹݃׮ ೞաঀ ੉޷ ٜ݅যઉ ੓ਵݴ
    AWS ECR 101

    View full-size slide

  9. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ECR Private Repository
    п ۨನ૑షܻ੄ ࣁࠗ ২࣌ਸ ߸҃ೡ ࣻ ੓णפ׮.
    ೐ۄ੉ࡁ ۨನ૑షܻܳ ࢤࢿೞҊ աݶ AWS ਢ ௑ࣛ ઝஏ ݫ׏ܳ ా೧
    AWS ECR 101

    View full-size slide

  10. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Terraform Modules for AWS ECR

    View full-size slide

  11. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо?
    Terraform Modules for AWS ECR
    “਋ࢶ పۄಬ AWS ೐۽߄੉؊ ޙࢲܳ ৌযࠇद׮.”
    https://registry.terraform.io/providers/hashicorp/aws/latest/docs

    View full-size slide

  12. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо?
    Terraform Modules for AWS ECR
    పۄಬ AWS ೐۽߄੉؊ ޙࢲܳ ഛੋ೧ࠁݶ ਤ৬ э਷ ୨ 7ѐ੄ ECR ҙ۲ ܻࣗझ ݾ۾ਸ ഛੋೡ ࣻ ੓णפ׮.

    View full-size slide

  13. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо?
    Terraform Modules for AWS ECR
    ECR ಌ࠶ܼ ੷੢ࣗী ؀೧ࢲח ੉ दрী ׮ܖ૑ ঋਵפ ECR Public ܻࣗझח ޖद೧઱दݶ ؾפ׮.

    View full-size slide

  14. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо?
    Terraform Modules for AWS ECR
    ੉ۧѱ 7ѐ੄ పۄಬ ܻࣗझী ؀೧ࢲ Ҋ޹೧ࠁݶ غѷҵਃ?
    aws_ecr_lifecycle_policy
    aws_ecr_pull_through_cache_rule
    aws_ecr_registry_policy
    aws_ecr_registry_scanning_con
    fi
    guration
    aws_ecr_repository
    aws_ecr_repository_policy
    aws_ecr_replication_con
    fi
    guration

    View full-size slide

  15. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо?
    Terraform Modules for AWS ECR
    “पઁ ѐ୓ ױਤੋ ۨ૑झ౟ܻ৬ ۨನ૑షܻ۽ ୶࢚ചೞݶ ҙܻо ખ ؊ ࣻਘೞ૑ ঋਸө?”
    ecr-repository
    ecr-registry

    View full-size slide

  16. ecr-registry ecr-repository
    Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо?
    Terraform Modules for AWS ECR
    ۨ૑झ౟ܻ৬ ۨನ૑షܻ пп ҙ۲ػ ܻࣗझٜਸ ޘযࠇद׮! 💪💪
    aws_ecr_lifecycle_policy
    aws_ecr_pull_through_cache_rule
    aws_ecr_registry_policy
    aws_ecr_registry_scanning_con
    fi
    guration
    aws_ecr_repository
    aws_ecr_repository_policy
    aws_ecr_replication_con
    fi
    guration

    View full-size slide

  17. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ݽٕ: ecr-registry
    Terraform Modules for AWS ECR
    ECR ۨ૑झ౟ܻ੄ ੿଼


    ࠂઁ(Replication)৬ ಽ झ۽ நद(Pull-through Cache) ੿଼ ੘ࢿ
    aws_ecr_registry_policy
    ecr-registry
    aws_ecr_pull_through_cache_rule
    aws_ecr_registry_policy
    aws_ecr_registry_scanning_con
    fi
    guration
    aws_ecr_replication_con
    fi
    guration
    0..1
    1
    0..N
    0..1
    ECR ۨ૑झ౟ܻ੄ ࠁউ झந׬ ࢸ੿ਵ۽ ӝࠄ ч਷ BASIC ఋੑ झந׬


    ENHANCED ఋੑ झந׬ਸ ా೧ AWS Inspector ӝ߈ ࠁউ Ѩࢎ оמ
    aws_ecr_registry_scanning_con
    fi
    guration
    ECR੉ ૑ਗೞח ಌ࠶ܼ ੷੢ࣗ(quay.io / ECR Public)੄ நय ҃۽ ࢸ੿
    aws_ecr_pull_through_cache_rule
    ECR ۨನ૑షܻٜਸ ࠂઁೡ ݾ੸૑ ECR ۨ૑झ౟ܻ ੿ࠁ ࢸ੿
    aws_ecr_replicatoin_con
    fi
    guration

    View full-size slide

  18. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ݽٕ: ecr-registry
    Terraform Modules for AWS ECR

    View full-size slide

  19. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ݽٕ: ecr-registry
    Terraform Modules for AWS ECR

    View full-size slide

  20. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ݽٕ: ecr-registry
    Terraform Modules for AWS ECR

    View full-size slide

  21. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ݽٕ: ecr-repository
    Terraform Modules for AWS ECR
    ecr-repository
    aws_ecr_lifecycle_policy
    aws_ecr_repository
    aws_ecr_repository_policy
    1
    0..1
    0..1
    ECR ۨನ૑షܻ
    aws_ecr_repository
    ECR ۨನ૑షܻ੄ ܻࣗझ ੿଼ਵ۽ ۨನ૑షܻী ؀ೠ ੽Ӕ ాઁ
    aws_ecr_repository_policy
    ECR ۨನ૑షܻ੄ ੉޷૑ ۄ੉೐ࢎ੉௿ ੿଼ ࢸ੿
    aws_ecr_lifecycle_policy

    View full-size slide

  22. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Terraform Modules for AWS ECR
    పۄಬ ݽٕ: ecr-repository

    View full-size slide

  23. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Terraform Modules for AWS ECR
    పۄಬ ݽٕ: ecr-repository

    View full-size slide

  24. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Terraform Modules for AWS ECR
    పۄಬ ݽٕ: ecr-repository

    View full-size slide

  25. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Terraform Modules for AWS ECR
    పۄಬ ݽٕ: ecr-repository

    View full-size slide

  26. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ݽٕ Ѿҗޛ
    Terraform Modules for AWS ECR
    https://github.com/tedilabs/terraform-aws-container
    tedilabs/terraform-aws-container
    https://registry.terraform.io/modules/tedilabs/container/aws/
    झఋ / ನ௼ / ஶ౟ܻ࠭࣌ / झಪࢲ ݽف ജ৔೤פ׮…! 🥕 🥕

    View full-size slide

  27. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Terraform Workspace for AWS ECR

    View full-size slide

  28. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    AWS ECR ۨ૑झ౟ܻ ҙܻ
    Terraform Workspace for AWS ECR

    View full-size slide

  29. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    AWS ECR ۨನ૑షܻ ҙܻ
    Terraform Workspace for AWS ECR

    View full-size slide

  30. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    AWS ECR ۨನ૑షܻ ҙܻ
    Terraform Workspace for AWS ECR

    View full-size slide

  31. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Extra for AWS ECR

    View full-size slide

  32. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    VPC PrivateLink ా೤
    Extra for AWS ECR
    AWS VPC৬ ؀࢚ ࢲ࠺झ р উ੹ೠ োѾਸ ਤೠ ӝࣿ


    Ҋоਊࢿ (High Availability) ߂ ഛ੢ࢿ (Scalability) ઁҕ


    ૑ਗೞח ؀࢚ ࢲ࠺झ


    - AWS ࢲ࠺झ (S3, ECR, KMS ١)


    - ׮ܲ AWS ҅੿ ࢚ীࢲ ઁҕೞח ࢲ࠺झ (VPC Endpoint Service)


    - AWS ݃௄೒ۨ੉झ ࢚੄ ౵౟ց ࢲ࠺झ
    AWS VPC PrivateLink
    A highly available, scalable technology that enables you to privately connect your VPC to supported AWS services,

    services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services.

    View full-size slide

  33. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    VPC PrivateLink ా೤
    Extra for AWS ECR
    بழ ۨ૑झ౟ܻ APIܳ ਤೠ ূ٘ನੋ౟


    ৈ۞ ࢲ࠳ بݫੋ — *.dkr.ecr.ap-northeast-2.amazonaws.com
    com.amazonaws.region.ecr.dkr
    AWS ECR APIܳ ਤೠ ূ٘ನੋ౟


    ױੌ بݫੋ — api.ecr.ap-northeast-2.amazonaws.com
    com.amazonaws.region.ecr.api

    View full-size slide

  34. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    VPC PrivateLink ా೤
    Extra for AWS ECR

    View full-size slide

  35. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Con
    fi
    g ҙܻഋ ӏ஗ ഝਊ
    Extra for AWS ECR
    AWS ܻࣗझ ҳࢿਸ ૑ࣘ੸ਵ۽ ݽפఠ݂ ߂ ӝ۾ೞҊ ӏ੿ ળࣻ ಣоܳ ૑ਗೞח ҙܻഋ ࢲ࠺झ


    - ఋ੐ۄੋ ࠭ܳ ా೧ ܻࣗझ ߸҃ࢎ೦ ୶੸


    - ܻࣗझ р ੄ઓࢿ ҙ҅ ୶੸


    - AWS SNS োزਸ ా೧ ܻࣗझ ߸҃ ঌۈ


    - Compliance as Codeܳ ాೠ Ѣߡքझ ߂ ӏ੿ ળࣻ ৈࠗ ઑࢎ
    AWS Con
    fi
    g
    Record and evaluate con
    fi
    gurations of your AWS resources

    View full-size slide

  36. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Con
    fi
    g ҙܻഋ ӏ஗ ഝਊ
    Extra for AWS ECR
    - ecr-private-image-scanning-enabled


    - ecr-private-lifecycle-policy-con
    fi
    gured


    - ecr-private-tag-immutability-enabled


    AWS ECR ҙ۲ ҙܻഋ ӏ஗

    View full-size slide

  37. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Con
    fi
    g ҙܻഋ ӏ஗ ഝਊ
    Extra for AWS ECR
    - ecr-private-image-scanning-enabled


    - ecr-private-lifecycle-policy-con
    fi
    gured


    - ecr-private-tag-immutability-enabled


    AWS ECR ҙ۲ ҙܻഋ ӏ஗

    View full-size slide

  38. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    Con
    fi
    g ҙܻഋ ӏ஗ ഝਊ
    Extra for AWS ECR

    View full-size slide

  39. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    FYI

    View full-size slide

  40. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    పۄಬ ௏٘ ҙܻী ؀೧ ؊ ҾӘೞ׮ݶ?
    FYI
    https://www.youtube.com/watch?v=yWhwZpzJ3no&t=2010s
    SpeakerDeck
    HashiTalk: Korea ࣁ࣌ীࢲ పۄಬ ௏٘ ҙܻী ؀೧ ؊ ੗ࣁೠ ղਊٜਸ ഛੋೡ ࣻ ੓णפ׮. 👏

    View full-size slide

  41. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    AWS PrivateLinkী ؀೧ ؊ ҾӘೞ׮ݶ?
    FYI
    https://www.youtube.com/watch?v=tBZBYozvTO8
    SpeakerDeck
    ׼Ӕ SRE ޿স ࣁ࣌ীࢲ AWS PrivateLink ഝਊী ؀೧ ؊ ੗ࣁೠ ղਊٜਸ ഛੋೡ ࣻ ੓णפ׮. 👏

    View full-size slide

  42. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    AWS Con
    fi
    gী ؀೧ ؊ ҾӘೞ׮ݶ?
    FYI
    SpeakerDeck
    AWS ݣ౭ য஠਍౟ ജ҃੄ AWS Con
    fi
    g ࢲ࠺झ ੸ਊী ؀೧ ؊ ੗ࣁೠ ղਊٜਸ ഛੋೡ ࣻ ੓णפ׮. 👏

    View full-size slide

  43. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐
    FYI
    https://www.facebook.com/groups/hashicorpkrug
    పۄಬী ؀ೠ ؊ ݆਷ ੿ࠁܳ ਗೞन׮ݶ ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐ী оੑ೧઱ࣁਃ! 😁

    View full-size slide

  44. ࣻಣ੸ੋ ࣗా — ૒ә X / ৔য੉ܴ / न܉৬ ୽ج / ైݺೠ ੿ࠁ ҕਬ


    ੗ਯҗ ଼੐ — מز੸ সޖ ࣻ೯ / ੗ਯ੸ ౸ױ


    ૌѩѱ ࢿ੢ — աࠁ׮ ڪযդ زܐ / ౱ ਕ௼ / ૌѢ਑


    ࢎਊ੗ ઺ब ࢎҊ — ࢎਊ੗ о஖ ୭਋ࢶ / ࢎਊ੗৬ ੿ࢲ੸ োѾ
    recruiting
    ੋ೐ۄ ౱ীࢲ ೣԋ ೡ زܐܳ ଺ইਃ! 👋
    Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    ੗ࣁೠ ղਊ਷ daangn.team ਸ ߑޙ೧઱ࣁਃ! :)
    SRE (Site Reliability Engineer)


    ׼Ӕಕ੉ ੋ೐ۄ ҳ୷ ߂ ਍৔


    Data Engineer


    ׼Ӕಕ੉ ؘ੉ఠ ೒ۖಬ ҳ୷ ߂ ਍৔
    ਋ܻח ੉ۧѱ ੌ೧ਃ
    ഌఖ ߂ ࠂ૑
    ੗ਯ੸ੋ ോо / ਬো ୹ృӔ / ੗ਯ ध࠺ ߂ рध࠺ ૑ਗ


    झగ٬ ؘझ௼ & ೲݢ޻۞ ੄੗ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ૑ਗ

    View full-size slide

  45. Byungjin Park · ⌂ posquit0.com · posquit0
    Copyright © 2022 All Rights Reserved.
    End of Document
    Visit my AMA (https://github.com/posquit0/ama) for any question!

    View full-size slide