feat: Cross account ECR for lambda functions

[dsme94]

what

• With the introduction of cross-account ECR for lambda functions, I have put together the necessary code to allow for this functionality

why

• Cross-account ECR is a feature many would use as it doesn't require you to duplicate your ECR repositories in the same account where the lambda function resides saving money

references

https://aws.amazon.com/blogs/compute/introducing-cross-account-amazon-ecr-access-for-aws-lambda/

[dsme94]

I've made the changes to this MR locally and tested it, works fine. I am not sure about the changes to using the existing policy document and I'll demonstrate why below.

  dynamic "statement" {
    for_each = var.principals_lambda

    content {
      effect  = "Allow"
      actions = [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]

      principals {
        type        = "Service"
        identifiers = ["lambda.amazonaws.com"]
      }

      condition {
        test     = "StringLike"
        values   = formatlist("arn:${data.aws_partition.current.partition}:lambda:*:%s:function:*", var.principals_lambda)
        variable = "aws:sourceArn"
      }
    }
  }

The above is the snippet of code that would be used if using the existing policy document. Having the code written like this in the module would produce a policy like this:

+ {
                      + Action    = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:BatchGetImage",
                        ]
                      + Condition = {
                          + StringLike = {
                              + aws:sourceArn = [
                                  + "arn:aws:lambda:*:222222222222:function:*",
                                  + "arn:aws:lambda:*:333333333333:function:*",
                                  + "arn:aws:lambda:*:444444444444:function:*",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                      + Sid       = ""
                    },
                  + {
                      + Action    = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:BatchGetImage",
                        ]
                      + Condition = {
                          + StringLike = {
                              + aws:sourceArn = [
                                  + "arn:aws:lambda:*:222222222222:function:*",
                                  + "arn:aws:lambda:*:333333333333:function:*",
                                  + "arn:aws:lambda:*:444444444444:function:*",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                      + Sid       = ""
                    },
                  + {
                      + Action    = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:BatchGetImage",
                        ]
                      + Condition = {
                          + StringLike = {
                              + aws:sourceArn = [
                                  + "arn:aws:lambda:*:222222222222:function:*",
                                  + "arn:aws:lambda:*:333333333333:function:*",
                                  + "arn:aws:lambda:*:444444444444:function:*",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                      + Sid       = ""
                    },

We would have duplicate statements for each item in principals_lambda.

Sticking to the existing method would allow us to write the policy like so:

+ {
                      + Action    = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:BatchGetImage",
                        ]
                      + Condition = {
                          + StringLike = {
                              + aws:sourceArn = [
                                  + "arn:aws:lambda:*:222222222222:function:*",
                                  + "arn:aws:lambda:*:333333333333:function:*",
                                  + "arn:aws:lambda:*:444444444444:function:*",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                      + Sid       = "LambdaECRImageCrossAccountRetrievalPolicy"
                    },
                  + {
                      + Action    = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:BatchGetImage",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "444444444444",
                              + "333333333333",
                              + "222222222222",
                            ]
                        }
                      + Sid       = "CrossAccountPermission"
                    },

I've tried for a few hours to get this to loop once but just can't seem to get it, and you can't pass a true/false value into for_each nor a string, must be a list.

My concern really is that the policy could grow exponentially in size hitting the AWS policy limit.

If there is a way to do the dynamic statement in the existing aws_policy_document I'd love to know!

[dsme94]

@lorengordon suggested using the length function with the dynamic statement which works perfectly. Updating MR.

  dynamic "statement" {
    for_each = length(var.principals_lambda) > 0 ? [1] : []

    content {
      sid = "LambdaECRImageCrossAccountRetrievalPolicy"
      effect  = "Allow"
      actions = [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]

      principals {
        type        = "Service"
        identifiers = ["lambda.amazonaws.com"]
      }

      condition {
        test     = "StringLike"
        values   = formatlist("arn:${data.aws_partition.current.partition}:lambda:*:%s:function:*", var.principals_lambda)
        variable = "aws:sourceArn"
      }
    }
  }

[matty-rose]

Hey is there anything blocking this PR? I'd love to be able to use this functionality and would be happy to assist in any way if needed @r351574nc3 @florian0410

[jamengual]

/test all

[jamengual]

please run

make init
make readme

and commit the changes

[matty-rose]

@dsme94 are you able to help with the above fixes?

[dsme94]

@jamengual @matty-rose - have pushed the new README created using make

Edit:

Have noticed:

identifiers = formatlist("arn:${data.aws_partition.current.partition}:iam::%s:root", var.principals_lambda)

Could be written better like so:

identifiers = formatlist("arn:%s:iam::%s:root", data.aws_partition.current.partition, var.principals_lambda)

Let me know if you would like me to update

[jamengual]

/test all

[jamengual]

on.curre

yes, please do

[dsme94]

@jamengual That's it done 👍

[jamengual]

/test all