Upgrade to Pro — share decks privately, control downloads, hide ads and more …

테라폼으로 ECR 관리하기 (How to Manage ECR with Terraform)

테라폼으로 ECR 관리하기 (How to Manage ECR with Terraform)

AWS의 관리형 컨테이너 이미지 저장소 서비스인 ECR을 테라폼으로 관리해온 경험을 공유합니다.

330c5e37fb238d6b319ae6e18770f44b?s=128

Byungjin Park

July 12, 2022
Tweet

More Decks by Byungjin Park

Other Decks in Programming

Transcript

  1. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. పۄಬਵ۽ ECR ҙܻೞӝ How to Manage AWS ECR with Terraform ߅ ߽૓ (Byungjin Park) · ௿۽٘ (Claud) · Site Reliability Engineer @ ׼Ӕಕ੉ AWS KRUG Container Jul 12, 2022
  2. speaker ߊ಴੗ ࣗѐ Byungjin Park · ⌂ posquit0.com · posquit0

    Copyright © 2022 All Rights Reserved. ߅߽૓ / @posquit0 / ௿۽٘ (Claud) (അ) Site Reliability Engineer @ ׼Ӕಕ੉ (੹) Director of Infrastructure Division @ ஠ࢎ௏ܻই (੹) Software Architect @ ১פযझ 
 (੹) Co-founder & Software Engineer @ ஠೒ۖ HashiCorp Ambassador / AWS Community Builder 
 Ҵઁ೧ఊ؀ഥ DEFCON CTF ࠄࢶ 6ഥ ૓୹ ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐ ਍৔ ೠҴ੄ য়೑ࣗझ ઺ GitHub 15,000ѐ ੉࢚੄ झఋܳ ߉਷ ೐۽ં౟
  3. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Agenda intro AWS ECR 101 Terraform Modules for AWS ECR AWS ECR ࢲ࠺झ੄ ӝࠄ੸ੋ ղਊী ؀೧ ࢓ಝࠇפ׮. AWS ECRਸ ബਯ੸ਵ۽ ҙܻೞӝ ਤೠ పۄಬ ݽٕਸ ݅ٚ җ੿ী ؀೧ ҕਬ೤פ׮. Terraform Workspace for AWS ECR పۄಬ ਕ௼झಕ੉झ ࢚ীࢲ पઁ۽ AWS ECRਸ ҙܻೞח ߑߨਸ ҕਬ೤פ׮. Extra for AWS ECR AWS ECRҗ ా೤ؼ ࣻ ੓ח ׮ܲ AWS ࢲ࠺झܳ рױೞѱ ࢓ಝࠇפ׮.
  4. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. AWS ECR 101
  5. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ECR (Elastic Container Registry) AWS ECR 101 ECR਷ AWS ജ҃ীࢲ ੷࠺ਊਵ۽ औҊ উ੿੸ਵ۽ ੉ਊೡ ࣻ ੓ח ஶప੉ց ੉޷૑ ੷੢ࣗ ࢲ࠺झੑפ׮. ؘ੉ఠ ੷੢ ࠺ਊ ߂ ֎౟ਕ௼ ࣠न ࠺ਊ݅ ࠗҗ AWSীࢲ ઁҕೞח ҙܻഋ ஶప੉ց ੉޷૑ ੷੢ࣗ ࢲ࠺झ
  6. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ઱ਃ ҳࢿਃࣗ ECR਷ ೐ۄ੉ࡁ ੷੢ࣗ৬ ಌ࠶ܼ ੷੢ࣗܳ ઁҕ೤פ׮. Private Registry Private Repository Public Registry Container Image Container Image Container Image Container Image Private Repository Public Repository Public Repository AWS ECR 101
  7. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ઱ਃ ҳࢿਃࣗ ੉ߣ दрীח ೐ۄ੉ࡁ ੉޷૑ ੷੢ࣗী ؀೧ࢲ݅ ׮ܛפ׮. 😁 Private Registry Private Repository Public Registry Container Image Container Image Container Image Container Image Private Repository Public Repository Public Repository AWS ECR 101
  8. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ECR Private Registry AWS ҅੿੄ п ܻ੹ ױਤ۽ ஶప੉ց ੉޷૑ ੷੢ࣗ ਍৔ ೞա੄ ۨ૑झ౟ܻח ৈ۞ ੉޷૑ ۨನ૑షܻ ҙܻ ૑৉ ࢲ࠺झ (Regional Service) ੉޷૑ ੷੢ࣗ р ࠂઁ (Replication) — Cross Regions / Cross Accounts ੉޷૑ ࠙ࢳਸ ాೠ ࠁউ ஂড੼ Ѩࢎ (Scanning) ಽ झܖ நद (Pull-through Cache) ׮নೠ ࠗо ӝמ ઁҕ ࢎਊ੗ח ۨ૑झ౟ܻী ؀ೠ ࣁࠗ ࢸ੿݅ ߸҃ೡ ࣻ ੓णפ׮. ECR ೐ۄ੉ࡁ ۨ૑झ౟ܻח AWS ҅੿੄ п ܻ੹݃׮ ೞաঀ ੉޷ ٜ݅যઉ ੓ਵݴ AWS ECR 101
  9. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ECR Private Repository п ۨನ૑షܻ੄ ࣁࠗ ২࣌ਸ ߸҃ೡ ࣻ ੓णפ׮. ೐ۄ੉ࡁ ۨನ૑షܻܳ ࢤࢿೞҊ աݶ AWS ਢ ௑ࣛ ઝஏ ݫ׏ܳ ా೧ AWS ECR 101
  10. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Terraform Modules for AWS ECR
  11. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо? Terraform Modules for AWS ECR “਋ࢶ పۄಬ AWS ೐۽߄੉؊ ޙࢲܳ ৌযࠇद׮.” https://registry.terraform.io/providers/hashicorp/aws/latest/docs
  12. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо? Terraform Modules for AWS ECR పۄಬ AWS ೐۽߄੉؊ ޙࢲܳ ഛੋ೧ࠁݶ ਤ৬ э਷ ୨ 7ѐ੄ ECR ҙ۲ ܻࣗझ ݾ۾ਸ ഛੋೡ ࣻ ੓णפ׮.
  13. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо? Terraform Modules for AWS ECR ECR ಌ࠶ܼ ੷੢ࣗী ؀೧ࢲח ੉ दрী ׮ܖ૑ ঋਵפ ECR Public ܻࣗझח ޖद೧઱दݶ ؾפ׮.
  14. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо? Terraform Modules for AWS ECR ੉ۧѱ 7ѐ੄ పۄಬ ܻࣗझী ؀೧ࢲ Ҋ޹೧ࠁݶ غѷҵਃ? aws_ecr_lifecycle_policy aws_ecr_pull_through_cache_rule aws_ecr_registry_policy aws_ecr_registry_scanning_con fi guration aws_ecr_repository aws_ecr_repository_policy aws_ecr_replication_con fi guration
  15. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо? Terraform Modules for AWS ECR “पઁ ѐ୓ ױਤੋ ۨ૑झ౟ܻ৬ ۨನ૑షܻ۽ ୶࢚ചೞݶ ҙܻо ખ ؊ ࣻਘೞ૑ ঋਸө?” ecr-repository ecr-registry
  16. ecr-registry ecr-repository Byungjin Park · ⌂ posquit0.com · posquit0 Copyright

    © 2022 All Rights Reserved. ޖट పۄಬ ݽٕਸ ٜ݅ Ѫੋо? Terraform Modules for AWS ECR ۨ૑झ౟ܻ৬ ۨನ૑షܻ пп ҙ۲ػ ܻࣗझٜਸ ޘযࠇद׮! 💪💪 aws_ecr_lifecycle_policy aws_ecr_pull_through_cache_rule aws_ecr_registry_policy aws_ecr_registry_scanning_con fi guration aws_ecr_repository aws_ecr_repository_policy aws_ecr_replication_con fi guration
  17. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. పۄಬ ݽٕ: ecr-registry Terraform Modules for AWS ECR ECR ۨ૑झ౟ܻ੄ ੿଼ ࠂઁ(Replication)৬ ಽ झ۽ நद(Pull-through Cache) ੿଼ ੘ࢿ aws_ecr_registry_policy ecr-registry aws_ecr_pull_through_cache_rule aws_ecr_registry_policy aws_ecr_registry_scanning_con fi guration aws_ecr_replication_con fi guration 0..1 1 0..N 0..1 ECR ۨ૑झ౟ܻ੄ ࠁউ झந׬ ࢸ੿ਵ۽ ӝࠄ ч਷ BASIC ఋੑ झந׬ ENHANCED ఋੑ झந׬ਸ ా೧ AWS Inspector ӝ߈ ࠁউ Ѩࢎ оמ aws_ecr_registry_scanning_con fi guration ECR੉ ૑ਗೞח ಌ࠶ܼ ੷੢ࣗ(quay.io / ECR Public)੄ நय ҃۽ ࢸ੿ aws_ecr_pull_through_cache_rule ECR ۨನ૑షܻٜਸ ࠂઁೡ ݾ੸૑ ECR ۨ૑झ౟ܻ ੿ࠁ ࢸ੿ aws_ecr_replicatoin_con fi guration
  18. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. పۄಬ ݽٕ: ecr-registry Terraform Modules for AWS ECR
  19. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. పۄಬ ݽٕ: ecr-registry Terraform Modules for AWS ECR
  20. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. పۄಬ ݽٕ: ecr-registry Terraform Modules for AWS ECR
  21. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. పۄಬ ݽٕ: ecr-repository Terraform Modules for AWS ECR ecr-repository aws_ecr_lifecycle_policy aws_ecr_repository aws_ecr_repository_policy 1 0..1 0..1 ECR ۨನ૑షܻ aws_ecr_repository ECR ۨನ૑షܻ੄ ܻࣗझ ੿଼ਵ۽ ۨನ૑షܻী ؀ೠ ੽Ӕ ాઁ aws_ecr_repository_policy ECR ۨನ૑షܻ੄ ੉޷૑ ۄ੉೐ࢎ੉௿ ੿଼ ࢸ੿ aws_ecr_lifecycle_policy
  22. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Terraform Modules for AWS ECR పۄಬ ݽٕ: ecr-repository
  23. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Terraform Modules for AWS ECR పۄಬ ݽٕ: ecr-repository
  24. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Terraform Modules for AWS ECR పۄಬ ݽٕ: ecr-repository
  25. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Terraform Modules for AWS ECR పۄಬ ݽٕ: ecr-repository
  26. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. పۄಬ ݽٕ Ѿҗޛ Terraform Modules for AWS ECR https://github.com/tedilabs/terraform-aws-container tedilabs/terraform-aws-container https://registry.terraform.io/modules/tedilabs/container/aws/ झఋ / ನ௼ / ஶ౟ܻ࠭࣌ / झಪࢲ ݽف ജ৔೤פ׮…! 🥕 🥕
  27. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Terraform Workspace for AWS ECR
  28. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. AWS ECR ۨ૑झ౟ܻ ҙܻ Terraform Workspace for AWS ECR
  29. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. AWS ECR ۨನ૑షܻ ҙܻ Terraform Workspace for AWS ECR
  30. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. AWS ECR ۨನ૑షܻ ҙܻ Terraform Workspace for AWS ECR
  31. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Extra for AWS ECR
  32. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. VPC PrivateLink ా೤ Extra for AWS ECR AWS VPC৬ ؀࢚ ࢲ࠺झ р উ੹ೠ োѾਸ ਤೠ ӝࣿ Ҋоਊࢿ (High Availability) ߂ ഛ੢ࢿ (Scalability) ઁҕ ૑ਗೞח ؀࢚ ࢲ࠺झ - AWS ࢲ࠺झ (S3, ECR, KMS ١) - ׮ܲ AWS ҅੿ ࢚ীࢲ ઁҕೞח ࢲ࠺झ (VPC Endpoint Service) - AWS ݃௄೒ۨ੉झ ࢚੄ ౵౟ց ࢲ࠺झ AWS VPC PrivateLink A highly available, scalable technology that enables you to privately connect your VPC to supported AWS services, 
 services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services.
  33. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. VPC PrivateLink ా೤ Extra for AWS ECR بழ ۨ૑झ౟ܻ APIܳ ਤೠ ূ٘ನੋ౟ ৈ۞ ࢲ࠳ بݫੋ — *.dkr.ecr.ap-northeast-2.amazonaws.com com.amazonaws.region.ecr.dkr AWS ECR APIܳ ਤೠ ূ٘ನੋ౟ ױੌ بݫੋ — api.ecr.ap-northeast-2.amazonaws.com com.amazonaws.region.ecr.api
  34. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. VPC PrivateLink ా೤ Extra for AWS ECR
  35. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Con fi g ҙܻഋ ӏ஗ ഝਊ Extra for AWS ECR AWS ܻࣗझ ҳࢿਸ ૑ࣘ੸ਵ۽ ݽפఠ݂ ߂ ӝ۾ೞҊ ӏ੿ ળࣻ ಣоܳ ૑ਗೞח ҙܻഋ ࢲ࠺झ - ఋ੐ۄੋ ࠭ܳ ా೧ ܻࣗझ ߸҃ࢎ೦ ୶੸ - ܻࣗझ р ੄ઓࢿ ҙ҅ ୶੸ - AWS SNS োزਸ ా೧ ܻࣗझ ߸҃ ঌۈ - Compliance as Codeܳ ాೠ Ѣߡքझ ߂ ӏ੿ ળࣻ ৈࠗ ઑࢎ AWS Con fi g Record and evaluate con fi gurations of your AWS resources
  36. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Con fi g ҙܻഋ ӏ஗ ഝਊ Extra for AWS ECR - ecr-private-image-scanning-enabled - ecr-private-lifecycle-policy-con fi gured - ecr-private-tag-immutability-enabled AWS ECR ҙ۲ ҙܻഋ ӏ஗
  37. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Con fi g ҙܻഋ ӏ஗ ഝਊ Extra for AWS ECR - ecr-private-image-scanning-enabled - ecr-private-lifecycle-policy-con fi gured - ecr-private-tag-immutability-enabled AWS ECR ҙ۲ ҙܻഋ ӏ஗
  38. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. Con fi g ҙܻഋ ӏ஗ ഝਊ Extra for AWS ECR
  39. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. FYI
  40. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. పۄಬ ௏٘ ҙܻী ؀೧ ؊ ҾӘೞ׮ݶ? FYI https://www.youtube.com/watch?v=yWhwZpzJ3no&t=2010s SpeakerDeck HashiTalk: Korea ࣁ࣌ীࢲ పۄಬ ௏٘ ҙܻী ؀೧ ؊ ੗ࣁೠ ղਊٜਸ ഛੋೡ ࣻ ੓णפ׮. 👏
  41. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. AWS PrivateLinkী ؀೧ ؊ ҾӘೞ׮ݶ? FYI https://www.youtube.com/watch?v=tBZBYozvTO8 SpeakerDeck ׼Ӕ SRE ޿স ࣁ࣌ীࢲ AWS PrivateLink ഝਊী ؀೧ ؊ ੗ࣁೠ ղਊٜਸ ഛੋೡ ࣻ ੓णפ׮. 👏
  42. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. AWS Con fi gী ؀೧ ؊ ҾӘೞ׮ݶ? FYI SpeakerDeck AWS ݣ౭ য஠਍౟ ജ҃੄ AWS Con fi g ࢲ࠺झ ੸ਊী ؀೧ ؊ ੗ࣁೠ ղਊٜਸ ഛੋೡ ࣻ ੓णפ׮. 👏
  43. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐ FYI https://www.facebook.com/groups/hashicorpkrug పۄಬী ؀ೠ ؊ ݆਷ ੿ࠁܳ ਗೞन׮ݶ ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐ী оੑ೧઱ࣁਃ! 😁
  44. ࣻಣ੸ੋ ࣗా — ૒ә X / ৔য੉ܴ / न܉৬ ୽ج

    / ైݺೠ ੿ࠁ ҕਬ ੗ਯҗ ଼੐ — מز੸ সޖ ࣻ೯ / ੗ਯ੸ ౸ױ ૌѩѱ ࢿ੢ — աࠁ׮ ڪযդ زܐ / ౱ ਕ௼ / ૌѢ਑ ࢎਊ੗ ઺ब ࢎҊ — ࢎਊ੗ о஖ ୭਋ࢶ / ࢎਊ੗৬ ੿ࢲ੸ োѾ recruiting ੋ೐ۄ ౱ীࢲ ೣԋ ೡ زܐܳ ଺ইਃ! 👋 Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022 All Rights Reserved. ੗ࣁೠ ղਊ਷ daangn.team ਸ ߑޙ೧઱ࣁਃ! :) SRE (Site Reliability Engineer) ׼Ӕಕ੉ ੋ೐ۄ ҳ୷ ߂ ਍৔ Data Engineer ׼Ӕಕ੉ ؘ੉ఠ ೒ۖಬ ҳ୷ ߂ ਍৔ ਋ܻח ੉ۧѱ ੌ೧ਃ ഌఖ ߂ ࠂ૑ ੗ਯ੸ੋ ോо / ਬো ୹ృӔ / ੗ਯ ध࠺ ߂ рध࠺ ૑ਗ झగ٬ ؘझ௼ & ೲݢ޻۞ ੄੗ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ૑ਗ
  45. Byungjin Park · ⌂ posquit0.com · posquit0 Copyright © 2022

    All Rights Reserved. End of Document Visit my AMA (https://github.com/posquit0/ama) for any question!