Terraform AWS ECR

ECR repositories with image scanning, immutable tags, KMS encryption, lifecycle policies, repository policies, replication, and controlled push and pull access.

Quick start

module "ecr" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"

  # ... your arguments here
}

module "ecr" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"

  # ... your arguments here
}

module "ecr" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"

  # ... your arguments here
}

module "ecr" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"

  # ... your arguments here
}

module "ecr" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"

  # ... your arguments here
}

module "ecr" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"

  # ... your arguments here
}

module "ecr" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"

  # ... your arguments here
}

module "ecr" {
  source  = "soc2.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "ecr" {
  source  = "terraform-aws-modules/ecr/aws"
  version = "~> 3.2"
}

module "ecr" {
  source  = "soc2.compliance.tf/terraform-aws-modules/ecr/aws"
  version = "~> 3.2"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "ecr" {
  source  = "terraform-aws-modules/ecr/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 2 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
ECR repositories should have image scan on push enabled	Low
ECR private repositories should have tag immutability configured	Low

Mapped compliance frameworks

Clause	Controls from this module
PR.PS-06	ECR repositories should have image scan on push enabled ECR private repositories should have tag immutability configured

Clause	Controls from this module
ACSC-EE-ML3-6.4: Patch operating systems ML3	ECR repositories should have image scan on push enabled

1 controls from this module are active under AWS Well-Architected Framework v10.

Clause	Controls from this module
RA-5: Vulnerability Scanning	ECR repositories should have image scan on push enabled

Clause	Controls from this module
SI-2(2): Automated Flaw Remediation Status	ECR repositories should have image scan on push enabled
SI-2(5): Automatic Software And Firmware Updates	ECR repositories should have image scan on push enabled

Clause	Controls from this module
11.3.1.3: 3 Internal vulnerability scans are performed after any significant change	ECR repositories should have image scan on push enabled
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.	ECR repositories should have image scan on push enabled

Clause	Controls from this module
3.1.a Identification and Classification of Information Assets	ECR private repositories should have tag immutability configured

Clause	Controls from this module
CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.	ECR repositories should have image scan on push enabled

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	PCI DSS v4.0	SOC 2
ECR repositories should have image scan on push enabled	Enforced	Enforced
ECR private repositories should have tag immutability configured	Not active	Not active

2 controls enforced with a source URL change.

Start free trial Get started