ECR Repository Tags Support is Broken

[eedwards-sk]

Overview

The API request for CreateRepository should include the tags, otherwise you cannot use IAM policies which restrict the API operation based on tags.

Current behavior does a "CreateRepository" API request, followed by a "TagResource" API request (see https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_ecr_repository.go#L60-L73)

This means that a proper locked down policy like this cannot work:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateRepo",
      "Effect": "Allow",
      "Action": [
        "ecr:CreateRepository",
        "ecr:TagResource"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/foo": "foo"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "foo"
          ]
        }
      }
    }
  ]
}

instead, you would have to use the following policy, which means the user ends up with permission to run CreateRepository on any kind of repository name / tag, which is a security risk and defeats the whole purpose of conditions...

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateRepo",
      "Effect": "Allow",
      "Action": [
        "ecr:CreateRepository"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "SetRepoTags",
      "Effect": "Allow",
      "Action": [
        "ecr:TagResource"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/foo": "foo"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "foo"
          ]
        }
      }
    }
  ]
}

Terraform Version

0.11.13
provider: 2.4.0

Affected Resource(s)

• aws_ecr_repository

Terraform Configuration Files

resource "aws_ecr_repository" "foo" {
  name = "foo"
  tags = {
    foo = "foo"
  }
}

Debug Output

2019-04-04T20:02:21.247Z [DEBUG] plugin.terraform-provider-aws_v2.4.0_x4: 2019/04/04 20:02:21 [DEBUG] [aws-sdk-go] {"__type":"AccessDeniedException","Message":"User: <SNIPPED> is not authorized to perform: ecr:CreateRepository on resource: *"}
2019-04-04T20:02:21.247Z [DEBUG] plugin.terraform-provider-aws_v2.4.0_x4: 2019/04/04 20:02:21 [DEBUG] [aws-sdk-go] DEBUG: Validate Response ecr/CreateRepository failed, not retrying, error AccessDeniedException: User: <SNIPPED> is not authorized to perform: ecr:CreateRepository on resource: *

Expected Behavior

The creation succeeds

Actual Behavior

The creation fails due to permissions

Steps to Reproduce

1. terraform apply

References

• https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-tagging.html

[ewbankkit]

Related:

• Feature request: Amazon ECR Repository tags #6896

[bflad]

Support for tagging on create has been merged and will release with version 2.5.0 of the Terraform AWS Provider, likely later today. 👍

[eedwards-sk]

wow, I think I heard the sonic boom from how fast that turnaround was 💥 😎

[bflad]

This has been released in version 2.5.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!