ecr-image-scan-lifecycle-immutable-tags-replication

{
  "command": "env | grep -E \"AWS|ENFORCE\" | sort",
  "description": "Check AWS environment variables"
}

{
  "command": "ls /app && which aws jq python3",
  "description": "List app directory and find tools"
}

{
  "command": "aws --version && aws sts get-caller-identity",
  "description": "Check AWS version and identity"
}

{
  "command": "ls -la /app/ 2>&1; echo \"---\"; ls /logs/agent/sessions/projects/-app/memory/ 2>&1",
  "description": "Inspect app and memory dirs"
}

{
  "command": "aws ecr describe-registry 2>&1 | head -20; echo \"---\"; aws ecr help 2>&1 | grep -E \"put-registry|put-replication|put-scanning|put-lifecycle\" | head",
  "description": "Check ECR registry commands"
}

{
  "command": "mkdir -p /app/policies /app/build && ls",
  "description": "Create working dirs"
}

{
  "file_path": "/app/policies/kms-key-policy.json",
  "content": "{\n  \"Version\": \"2012-10-17\",\n  \"Id\": \"harbor-ecr-cmk\",\n  \"Statement\": [\n    {\n      \"Sid\": \"EnableRoot\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\"AWS\": \"arn:aws:iam::000000000000:root\"},\n      \"Action\": \"kms:*\",\n      \"Resource\": \"*\"\n    },\n    {\n      \"Sid\": \"AllowECRServiceEnvelope\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\"Service\": \"ecr.amazonaws.com\"},\n      \"Action\": [\n        \"kms:Decrypt\",\n        \"kms:Encrypt\",\n        \"kms:GenerateDataKey\",\n        \"kms:GenerateDataKeyWithoutPlaintext\",\n        \"kms:ReEncrypt*\",\n        \"kms:DescribeKey\",\n        \"kms:CreateGrant\"\n      ],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Sid\": \"AllowECRReplicationSLR\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::000000000000:role/aws-service-role/replication.ecr.amazonaws.com/AWSServiceRoleForECRReplication\"\n      },\n      \"Action\": [\n        \"kms:Decrypt\",\n        \"kms:Encrypt\",\n        \"kms:GenerateDataKey\",\n        \"kms:GenerateDataKeyWithoutPlaintext\",\n        \"kms:ReEncrypt*\",\n        \"kms:DescribeKey\",\n        \"kms:CreateGrant\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n"
}

{
  "file_path": "/app/policies/prod-repo-policy.json",
  "content": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"OrgWidePullReadOnly\",\n      \"Effect\": \"Allow\",\n      \"Principal\": \"*\",\n      \"Action\": [\n        \"ecr:GetDownloadUrlForLayer\",\n        \"ecr:BatchGetImage\",\n        \"ecr:BatchCheckLayerAvailability\",\n        \"ecr:DescribeImages\",\n        \"ecr:DescribeRepositories\",\n        \"ecr:ListImages\"\n      ],\n      \"Condition\": {\n        \"StringEquals\": {\n          \"aws:PrincipalOrgID\": \"${ORG_ID}\"\n        }\n      }\n    },\n    {\n      \"Sid\": \"CentralOpsPushOnly\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\"AWS\": \"arn:aws:iam::000000000001:root\"},\n      \"Action\": [\n        \"ecr:PutImage\",\n        \"ecr:InitiateLayerUpload\",\n        \"ecr:UploadLayerPart\",\n        \"ecr:CompleteLayerUpload\",\n        \"ecr:BatchCheckLayerAvailability\"\n      ]\n    }\n  ]\n}\n"
}

{
  "file_path": "/app/policies/prod-lifecycle.json",
  "content": "{\n  \"rules\": [\n    {\n      \"rulePriority\": 1,\n      \"description\": \"Retain at least the 10 most recent semver releases (v*).\",\n      \"selection\": {\n        \"tagStatus\": \"tagged\",\n        \"tagPatternList\": [\"v*\"],\n        \"countType\": \"imageCountMoreThan\",\n        \"countNumber\": 10\n      },\n      \"action\": {\"type\": \"expire\"}\n    },\n    {\n      \"rulePriority\": 2,\n      \"description\": \"Expire git-sha builds (sha-*) older than 21 days.\",\n      \"selection\": {\n        \"tagStatus\": \"tagged\",\n        \"tagPrefixList\": [\"sha-\"],\n        \"countType\": \"sinceImagePushed\",\n        \"countUnit\": \"days\",\n        \"countNumber\": 21\n      },\n      \"action\": {\"type\": \"expire\"}\n    },\n    {\n      \"rulePriority\": 3,\n      \"description\": \"Expire untagged stragglers older than 3 days.\",\n      \"selection\": {\n        \"tagStatus\": \"untagged\",\n        \"countType\": \"sinceImagePushed\",\n        \"countUnit\": \"days\",\n        \"countNumber\": 3\n      },\n      \"action\": {\"type\": \"expire\"}\n    },\n    {\n      \"rulePriority\": 4,\n      \"description\": \"Long-tail catch-all: expire any image older than 180 days.\",\n      \"selection\": {\n        \"tagStatus\": \"any\",\n        \"countType\": \"sinceImagePushed\",\n        \"countUnit\": \"days\",\n        \"countNumber\": 180\n      },\n      \"action\": {\"type\": \"expire\"}\n    }\n  ]\n}\n"
}

{
  "file_path": "/app/policies/replication.json",
  "content": "{\n  \"rules\": [\n    {\n      \"destinations\": [\n        {\"region\": \"us-west-2\", \"registryId\": \"000000000000\"}\n      ],\n      \"repositoryFilters\": [\n        {\"filter\": \"harbor-prod-\", \"filterType\": \"PREFIX_MATCH\"}\n      ]\n    },\n    {\n      \"destinations\": [\n        {\"region\": \"us-west-2\", \"registryId\": \"000000000000\"},\n        {\"region\": \"eu-west-1\", \"registryId\": \"000000000000\"}\n      ],\n      \"repositoryFilters\": [\n        {\"filter\": \"harbor-stage-\", \"filterType\": \"PREFIX_MATCH\"}\n      ]\n    }\n  ]\n}\n"
}

{
  "file_path": "/app/policies/scanning.json",
  "content": "{\n  \"scanType\": \"BASIC\",\n  \"rules\": [\n    {\n      \"scanFrequency\": \"SCAN_ON_PUSH\",\n      \"repositoryFilters\": [\n        {\"filter\": \"harbor-*\", \"filterType\": \"WILDCARD\"}\n      ]\n    }\n  ]\n}\n"
}

{
  "file_path": "/app/policies/registry-permissions.json",
  "content": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AllowCrossAccountReplicationFromOps\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\"AWS\": \"arn:aws:iam::000000000001:root\"},\n      \"Action\": [\n        \"ecr:CreateRepository\",\n        \"ecr:ReplicateImage\"\n      ],\n      \"Resource\": \"arn:aws:ecr:us-east-1:000000000000:repository/*\"\n    }\n  ]\n}\n"
}

{
  "query": "select:TodoWrite",
  "max_results": 1
}

{
  "todos": [
    {
      "content": "Create CMK + alias harbor-ecr-cmk with ECR + replication SLR policy",
      "activeForm": "Creating CMK + alias",
      "status": "in_progress"
    },
    {
      "content": "Create both ECR repos with KMS, scan-on-push, immutable, tags",
      "activeForm": "Creating ECR repos",
      "status": "pending"
    },
    {
      "content": "Apply prod repo policy (org pull + ops push)",
      "activeForm": "Applying prod repo policy",
      "status": "pending"
    },
    {
      "content": "Apply prod 4-rule lifecycle policy",
      "activeForm": "Applying lifecycle policy",
      "status": "pending"
    },
    {
      "content": "Apply registry replication, scanning, and permissions policy",
      "activeForm": "Applying registry-level config",
      "status": "pending"
    },
    {
      "content": "Publish SSM manifest",
      "activeForm": "Publishing SSM manifest",
      "status": "pending"
    },
    {
      "content": "Verify end state",
      "activeForm": "Verifying end state",
      "status": "pending"
    }
  ]
}

{
  "file_path": "/app/build/build.sh",
  "content": "#!/usr/bin/env bash\nset -euo pipefail\n\nACCOUNT=000000000000\nOPS_ACCOUNT=000000000001\nREGION=us-east-1\nORG_ID=\"o-harbor00ecr\"   # placeholder org id; published at /harbor/ecr/org-id\n\nPOL=/app/policies\n\n# --- 1. KMS CMK + alias --------------------------------------------------\necho \">> creating CMK\"\nKEY_JSON=$(aws kms create-key \\\n  --description \"Harbor ECR envelope CMK\" \\\n  --key-usage ENCRYPT_DECRYPT \\\n  --key-spec SYMMETRIC_DEFAULT \\\n  --policy \"file://${POL}/kms-key-policy.json\" \\\n  --tags TagKey=App,TagValue=harbor TagKey=Purpose,TagValue=ecr-envelope)\nKEY_ID=$(echo \"$KEY_JSON\" | jq -r '.KeyMetadata.KeyId')\nKEY_ARN=$(echo \"$KEY_JSON\" | jq -r '.KeyMetadata.Arn')\necho \"   KeyId=$KEY_ID\"\n\n# Idempotent alias: delete-if-exists, then create.\naws kms delete-alias --alias-name alias/harbor-ecr-cmk 2>/dev/null || true\naws kms create-alias \\\n  --alias-name alias/harbor-ecr-cmk \\\n  --target-key-id \"$KEY_ID\"\n\n# --- 2. ECR repositories -------------------------------------------------\nfor pair in \"harbor-prod-svc:prod\" \"harbor-stage-svc:stage\"; do\n  name=\"${pair%%:*}\"\n  env=\"${pair##*:}\"\n  echo \">> creating repo $name (Env=$env)\"\n  aws ecr create-repository \\\n    --repository-name \"$name\" \\\n    --image-tag-mutability IMMUTABLE \\\n    --image-scanning-configuration scanOnPush=true \\\n    --encryption-configuration \"encryptionType=KMS,kmsKey=${KEY_ARN}\" \\\n    --tags \"Key=Env,Value=${env}\" \"Key=App,Value=harbor\"\ndone\n\nPROD_ARN=$(aws ecr describe-repositories --repository-names harbor-prod-svc \\\n  --query 'repositories[0].repositoryArn' --output text)\nPROD_URI=$(aws ecr describe-repositories --repository-names harbor-prod-svc \\\n  --query 'repositories[0].repositoryUri' --output text)\nSTAGE_ARN=$(aws ecr describe-repositories --repository-names harbor-stage-svc \\\n  --query 'repositories[0].repositoryArn' --output text)\nSTAGE_URI=$(aws ecr describe-repositories --repository-names harbor-stage-svc \\\n  --query 'repositories[0].repositoryUri' --output text)\n\n# --- 3. Prod repo policy: org pull + ops push ----------------------------\necho \">> applying prod repo policy\"\nsed \"s|\\${ORG_ID}|${ORG_ID}|g\" \"${POL}/prod-repo-policy.json\" \\\n  > /tmp/prod-repo-policy.rendered.json\naws ecr set-repository-policy \\\n  --repository-name harbor-prod-svc \\\n  --policy-text \"file:///tmp/prod-repo-policy.rendered.json\"\n\n# --- 4. Prod lifecycle policy (4 rules) ----------------------------------\necho \">> applying prod lifecycle policy\"\naws ecr put-lifecycle-policy \\\n  --repository-name harbor-prod-svc \\\n  --lifecycle-policy-text \"file://${POL}/prod-lifecycle.json\"\n\n# --- 5. Registry replication --------------------------------------------\necho \">> applying registry replication\"\naws ecr put-replication-configuration \\\n  --replication-configuration \"file://${POL}/replication.json\"\n\n# --- 6. Registry scanning -----------------------------------------------\necho \">> applying registry scanning\"\naws ecr put-registry-scanning-configuration \\\n  --cli-input-json \"file://${POL}/scanning.json\"\n\n# --- 7. Registry permissions policy --------------------------------------\necho \">> applying registry permissions policy\"\naws ecr put-registry-policy \\\n  --policy-text \"file://${POL}/registry-permissions.json\"\n\n# --- 8. SSM manifest -----------------------------------------------------\necho \">> publishing SSM manifest\"\nput() {\n  aws ssm put-parameter --overwrite --type String --name \"$1\" --value \"$2\" >/dev/null\n  printf '   %-44s -> %s\\n' \"$1\" \"$2\"\n}\nput /harbor/ecr/prod-repo-name              harbor-prod-svc\nput /harbor/ecr/prod-repo-arn               \"$PROD_ARN\"\nput /harbor/ecr/prod-repo-uri               \"$PROD_URI\"\nput /harbor/ecr/stage-repo-name             harbor-stage-svc\nput /harbor/ecr/stage-repo-arn              \"$STAGE_ARN\"\nput /harbor/
…[truncated]

{
  "command": "chmod +x /app/build/build.sh && bash /app/build/build.sh",
  "description": "Run the ECR build"
}

{
  "command": "aws ecr put-registry-scanning-configuration --cli-input-json \"file:///app/policies/scanning.json\" 2>&1 | head -20; echo \"---REGISTRY POLICY---\"; aws ecr put-registry-policy --policy-text \"file:///app/policies/registry-permissions.json\" 2>&1 | head -20",
  "description": "Try scanning and registry permissions"
}

{
  "command": "aws ecr put-replication-configuration --replication-configuration \"file:///app/policies/replication.json\" 2>&1 | head -5\necho \"---\"\n# try with cli-input-json wrapper as alt\necho '{\"replicationConfiguration\":' > /tmp/rep-wrapped.json\ncat /app/policies/replication.json >> /tmp/rep-wrapped.json\necho '}' >> /tmp/rep-wrapped.json\naws ecr put-replication-configuration --cli-input-json \"file:///tmp/rep-wrapped.json\" 2>&1 | head -5",
  "description": "Retry replication; try wrapped input"
}

{
  "todos": [
    {
      "content": "Create CMK + alias harbor-ecr-cmk with ECR + replication SLR policy",
      "activeForm": "Creating CMK + alias",
      "status": "completed"
    },
    {
      "content": "Create both ECR repos with KMS, scan-on-push, immutable, tags",
      "activeForm": "Creating ECR repos",
      "status": "completed"
    },
    {
      "content": "Apply prod repo policy (org pull + ops push)",
      "activeForm": "Applying prod repo policy",
      "status": "completed"
    },
    {
      "content": "Apply prod 4-rule lifecycle policy",
      "activeForm": "Applying lifecycle policy",
      "status": "completed"
    },
    {
      "content": "Apply registry replication, scanning, and permissions policy",
      "activeForm": "Applying registry-level config",
      "status": "in_progress"
    },
    {
      "content": "Publish SSM manifest",
      "activeForm": "Publishing SSM manifest",
      "status": "pending"
    },
    {
      "content": "Verify end state",
      "activeForm": "Verifying end state",
      "status": "pending"
    }
  ]
}

{
  "command": "set -e\nACCOUNT=000000000000\nOPS_ACCOUNT=000000000001\nORG_ID=\"o-harbor00ecr\"\nKEY_ARN=$(aws kms describe-key --key-id alias/harbor-ecr-cmk --query 'KeyMetadata.Arn' --output text)\nPROD_ARN=$(aws ecr describe-repositories --repository-names harbor-prod-svc --query 'repositories[0].repositoryArn' --output text)\nPROD_URI=$(aws ecr describe-repositories --repository-names harbor-prod-svc --query 'repositories[0].repositoryUri' --output text)\nSTAGE_ARN=$(aws ecr describe-repositories --repository-names harbor-stage-svc --query 'repositories[0].repositoryArn' --output text)\nSTAGE_URI=$(aws ecr describe-repositories --repository-names harbor-stage-svc --query 'repositories[0].repositoryUri' --output text)\n\nput() { aws ssm put-parameter --overwrite --type String --name \"$1\" --value \"$2\" >/dev/null && printf '   %-44s -> %s\\n' \"$1\" \"$2\"; }\nput /harbor/ecr/prod-repo-name              harbor-prod-svc\nput /harbor/ecr/prod-repo-arn               \"$PROD_ARN\"\nput /harbor/ecr/prod-repo-uri               \"$PROD_URI\"\nput /harbor/ecr/stage-repo-name             harbor-stage-svc\nput /harbor/ecr/stage-repo-arn              \"$STAGE_ARN\"\nput /harbor/ecr/stage-repo-uri              \"$STAGE_URI\"\nput /harbor/ecr/cmk-arn                     \"$KEY_ARN\"\nput /harbor/ecr/cmk-alias                   alias/harbor-ecr-cmk\nput /harbor/ecr/cross-account               \"$OPS_ACCOUNT\"\nput /harbor/ecr/org-id                      \"$ORG_ID\"\nput /harbor/ecr/replication-region-primary  us-west-2\nput /harbor/ecr/replication-region-secondary eu-west-1\nput /harbor/ecr/scan-type                   BASIC\n\naws ssm put-parameter --overwrite --type String \\\n  --name /harbor/ecr/replication-manifest \\\n  --value \"$(cat /app/policies/replication.json)\" >/dev/null && echo \"   /harbor/ecr/replication-manifest         -> (json)\"\naws ssm put-parameter --overwrite --type String \\\n  --name /harbor/ecr/scanning-manifest \\\n  --value \"$(cat /app/policies/scanning.json)\" >/dev/null && echo \"   /harbor/ecr/scanning-manifest            -> (json)\"",
  "description": "Publish SSM manifest"
}

{
  "command": "set -e\necho \"=== KMS alias + key policy admits ECR + replication SLR ===\"\naws kms describe-key --key-id alias/harbor-ecr-cmk --query 'KeyMetadata.{Arn:Arn,KeyManager:KeyManager,KeyState:KeyState}'\naws kms get-key-policy --key-id alias/harbor-ecr-cmk --policy-name default --output text \\\n  | jq '[.Statement[] | {Sid, Principal: (.Principal | tostring | .[0:80])}]'\n\necho\necho \"=== Repos: encryption / mutability / scan-on-push / tags ===\"\nfor r in harbor-prod-svc harbor-stage-svc; do\n  aws ecr describe-repositories --repository-names \"$r\" \\\n    --query 'repositories[0].{name:repositoryName,mut:imageTagMutability,scan:imageScanningConfiguration.scanOnPush,enc:encryptionConfiguration}'\n  aws ecr list-tags-for-resource \\\n    --resource-arn \"$(aws ecr describe-repositories --repository-names $r --query 'repositories[0].repositoryArn' --output text)\" \\\n    --query 'tags'\ndone\n\necho\necho \"=== Prod repo policy: 2 statements, no put on pull principal ===\"\naws ecr get-repository-policy --repository-name harbor-prod-svc --query 'policyText' --output text \\\n  | jq '[.Statement[] | {Sid, Effect, Principal, Actions: .Action, HasOrgCondition: (.Condition.StringEquals.\"aws:PrincipalOrgID\" // null)}]'\n\necho\necho \"=== Lifecycle: 4 rules, ascending priorities, all expire ===\"\naws ecr get-lifecycle-policy --repository-name harbor-prod-svc --query 'lifecyclePolicyText' --output text \\\n  | jq '[.rules[] | {pri: .rulePriority, action: .action.type, sel: .selection}]'\n\necho\necho \"=== Registry scanning ===\"\naws ecr get-registry-scanning-configuration\n\necho\necho \"=== Registry permissions policy ===\"\naws ecr get-registry-policy --query 'policyText' --output text | jq .\n\necho\necho \"=== Replication (API state , feature disabled here, see SSM manifest fallback) ===\"\naws ecr describe-registry --query 'replicationConfiguration'\naws ssm get-parameter --name /harbor/ecr/replication-manifest --query 'Parameter.Value' --output text | jq '.rules | map({prefix: .repositoryFilters[0].filter, dests: [.destinations[] | \"\\(.region)@\\(.registryId)\"]})'\n\necho\necho \"=== SSM manifest ===\"\naws ssm get-parameters-by-path --path /harbor/ecr/ --recursive --query 'Parameters[].[Name,Value]' --output text | sort",
  "description": "Verify end state"
}

{
  "todos": [
    {
      "content": "Create CMK + alias harbor-ecr-cmk with ECR + replication SLR policy",
      "activeForm": "Creating CMK + alias",
      "status": "completed"
    },
    {
      "content": "Create both ECR repos with KMS, scan-on-push, immutable, tags",
      "activeForm": "Creating ECR repos",
      "status": "completed"
    },
    {
      "content": "Apply prod repo policy (org pull + ops push)",
      "activeForm": "Applying prod repo policy",
      "status": "completed"
    },
    {
      "content": "Apply prod 4-rule lifecycle policy",
      "activeForm": "Applying lifecycle policy",
      "status": "completed"
    },
    {
      "content": "Apply registry replication, scanning, and permissions policy",
      "activeForm": "Applying registry-level config",
      "status": "completed"
    },
    {
      "content": "Publish SSM manifest",
      "activeForm": "Publishing SSM manifest",
      "status": "completed"
    },
    {
      "content": "Verify end state",
      "activeForm": "Verifying end state",
      "status": "completed"
    }
  ]
}