Skip to content

Commit 6109999

Browse files
SoManyHsSoManyHs
committed
Merge branch 'hhh-fips' into dev
2 parents 01bbeca + e5e29d7 commit 6109999

File tree

10 files changed

+277
-143
lines changed

10 files changed

+277
-143
lines changed

‎README.md

Lines changed: 32 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ Line Interface](http://aws.amazon.com/cli/) product detail page.
3434
- [Using Route53 Service Discovery](#using-route53-service-discovery)
3535
- [Viewing Running Tasks](#viewing-running-tasks)
3636
- [Viewing Container Logs](#viewing-container-logs)
37-
- [Using Private Registry Authentication](#using-private-registry-authentication)
37+
- [Using FIPS Endpoints](#using-fips-endpoints)
38+
- [Using Private Registry Authentication](#using-private-registry-authentication)
3839
- [Amazon ECS CLI Commands](#amazon-ecs-cli-commands)
3940
- [Contributing to the CLI](#contributing-to-the-cli)
4041
- [License](#license)
@@ -338,17 +339,17 @@ For the EC2 launch type, the ECS CLI always creates EC2 instances that include t
338339
echo ECS_CLUSTER={ clusterName } >> /etc/ecs/ecs.config
339340
```
340341

341-
This user data directs the EC2 instance to join your ECS Cluster. You can optionally include extra user data with `--extra-user-data`; this flag takes a file name as its argument.
342+
This user data directs the EC2 instance to join your ECS Cluster. You can optionally include extra user data with `--extra-user-data`; this flag takes a file name as its argument.
342343
The flag can be used multiple times to specify multiple files. Extra user data can be shell scripts or cloud-init directives- see the [EC2 documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html) for more information.
343344
The ECS CLI takes all the User Data, and packs it into a MIME Multipart archive which can be used by cloud-init on the EC2 instance. The ECS CLI even allows existing MIME Multipart archives to be passed in with `--extra-user-data`.
344345
The CLI will unpack the existing archive, and then repack it into the final archive (preserving all header and content type information). Here is an example of specifying extra user data:
345346

346347
```
347-
ecs-cli up \
348-
--capability-iam \
349-
--extra-user-data my-shellscript \
350-
--extra-user-data my-cloud-boot-hook \
351-
--extra-user-data my-mime-multipart-archive \
348+
ecs-cli up \
349+
--capability-iam \
350+
--extra-user-data my-shellscript \
351+
--extra-user-data my-cloud-boot-hook \
352+
--extra-user-data my-mime-multipart-archive \
352353
--launch-type EC2
353354
```
354355

@@ -850,7 +851,26 @@ OPTIONS:
850851
--timestamps, -t [Optional] Shows timestamps on each line in the log output.
851852
```
852853

853-
## Using Private Registry Authentication
854+
### Using FIPS Endpoints
855+
The ECS-CLI supports using [FIPS endpoints](https://aws.amazon.com/compliance/fips/) for calls to ECR. To ensure you are accessing ECR using FIPS endpoints, use the `--use-fips` flag on the `push`, `pull`, or `images` command. FIPS endpoints are currently available in us-west-1, us-west-2, us-east-1, us-east-2, and in the [GovCloud partition](https://docs.aws.amazon.com/govcloud-us/latest/ug-west/using-govcloud-endpoints.html).
856+
857+
```
858+
$ ecs-cli push myRepository:latest --use-fips --debug
859+
DEBU[0000] Using FIPS endpoint: https://ecr-fips.us-west-2.amazonaws.com
860+
INFO[0000] Getting AWS account ID...
861+
DEBU[0000] Getting authorization token...
862+
DEBU[0000] Checking file cache registry=xxxxxxxxxx123
863+
DEBU[0000] Calling ECR.GetAuthorizationToken registry=xxxxxxxxxx123
864+
DEBU[0000] Saving credentials to file cache registry=xxxxxxxxxx123
865+
DEBU[0000] Retrieved authorization token via endpoint: https://xxxxxxxxxxx123.dkr.ecr-fips.us-west-2.amazonaws.com
866+
INFO[0000] Tagging image image=myRepository repository=xxxxxxxxxxx123.dkr.ecr-fips.us-west-2.amazonaws.com/myRepository tag=latest
867+
INFO[0000] Image tagged
868+
DEBU[0000] Check if repository exists repository=myRepository
869+
INFO[0000] Pushing image repository=xxxxxxxxxxx123.dkr.ecr-fips.us-west-2.amazonaws.com/myRepository tag=latest
870+
INFO[0002] Image pushed
871+
```
872+
873+
### Using Private Registry Authentication
854874

855875
If you want to use privately hosted container images with ECS, the ECS CLI can store your private registry credentials in AWS Secrets Manager and create an IAM role which ECS can use to access the credentials and private images. This allows you to:
856876

@@ -863,7 +883,7 @@ Using privately hosted images with the ECS CLI is done in two parts:
863883
1) Create new AWS Secrets Manager secrets and an IAM Task Execution Role with `ecs-cli registry-creds up`
864884
2) Run `ecs-cli compose` commands to create and run a task definition that includes the new resources
865885

866-
### Storing private registry credentials with `ecs-cli registry-creds up`
886+
#### Storing private registry credentials with `ecs-cli registry-creds up`
867887

868888
To get started, first create an input file that contains the name of your registry and the credentials needed to access it:
869889

@@ -876,7 +896,7 @@ registry_credentials:
876896
my-registry.example.com:
877897
secrets_manager_arn: # required when using (with no modification) or updating an existing secret
878898
username: myUserName # required when creating or updating a new secret
879-
password: ${MY_PASSWORD} # required when creating or updating a new secret
899+
password: ${MY_PASSWORD} # required when creating or updating a new secret
880900
kms_key_id: # optional custom KMS Key ID to use to encrypt new secret
881901
container_names: # required to match credential resources with docker-compose services
882902
- web
@@ -891,7 +911,7 @@ Other options:
891911
* If you want to encrypt the AWS Secrets Manager secret for your registry with a custom KMS Key, then add the ARN, ID or Alias of the Key in the `kms_key_id` field. Otherwise, AWS Secrets Manager will use the default key in your account.
892912
* If you don't want to create or update an IAM Task Execution Role for these secrets, use the `--no-role` flag instead of specifying a role name.
893913
* If you don't want to generate an output file for use with `compose` or for records purposes, use the `--no-output-file` flag.
894-
* If you want the output file to be created in a specific directory on your machine, you can specify it with the `--output-dir <value>` flag. Otherwise, the file will be created in your working directory.
914+
* If you want the output file to be created in a specific directory on your machine, you can specify it with the `--output-dir <value>` flag. Otherwise, the file will be created in your working directory.
895915

896916
After creating the input file, run the `registry-creds up` command on the file and pass in the name of the new or existing Task Execution Role you want to use for the secrets:
897917

@@ -933,7 +953,7 @@ This file contains:
933953

934954
We can now use this file with `ecs-cli compose` commands to start a task with images in our private registry.
935955

936-
### Using private registry credentials when launching tasks or services
956+
#### Using private registry credentials when launching tasks or services
937957

938958
Now that we have an output file that identifies which resources we need to use our private registry, the ECS CLI will incorporate them into our Docker Compose project when we run `ecs-cli compose`.
939959

@@ -984,7 +1004,6 @@ INFO[0018] Started container... container=bf35a813-dd76-4fe0-b5a2-c1334c2331f4/l
9841004

9851005
For more information about using private registries with ECS, see [Private Registry Authentication for Tasks](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html).
9861006

987-
9881007
## Amazon ECS CLI Commands
9891008

9901009
For a complete list of commands, see the

‎ecs-cli/modules/cli/image/image_app.go

Lines changed: 38 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,8 @@ func ImagePush(c *cli.Context) {
6565
if err != nil {
6666
logrus.Fatal("Error executing 'push': ", err)
6767
}
68-
ecrClient := ecrclient.NewClient(commandConfig)
68+
69+
ecrClient := getECRClient(c, commandConfig)
6970
stsClient := stsclient.NewClient(commandConfig)
7071

7172
if err := pushImage(c, rdwr, dockerClient, ecrClient, stsClient); err != nil {
@@ -89,7 +90,8 @@ func ImagePull(c *cli.Context) {
8990
if err != nil {
9091
logrus.Fatal("Error executing 'pull': ", err)
9192
}
92-
ecrClient := ecrclient.NewClient(commandConfig)
93+
94+
ecrClient := getECRClient(c, commandConfig)
9395
stsClient := stsclient.NewClient(commandConfig)
9496

9597
if err := pullImage(c, rdwr, dockerClient, ecrClient, stsClient); err != nil {
@@ -109,15 +111,32 @@ func ImageList(c *cli.Context) {
109111
logrus.Fatal("Error executing 'images': ", err)
110112
}
111113

112-
ecrClient := ecrclient.NewClient(commandConfig)
114+
ecrClient := getECRClient(c, commandConfig)
115+
113116
if err := getImages(c, rdwr, ecrClient); err != nil {
114117
logrus.Fatal("Error executing 'images': ", err)
115118
return
116119
}
117120
}
118121

122+
func getECRClient(c *cli.Context, commandConfig *config.CommandConfig) ecrclient.Client {
123+
ecrClient := ecrclient.NewClient(commandConfig)
124+
125+
useFips := c.Bool(flags.UseFIPSFlag)
126+
127+
if useFips {
128+
fipsClient, err := ecrclient.NewFipsClient(commandConfig)
129+
if err != nil {
130+
logrus.Fatal("Error creating FIPS client: ", err)
131+
}
132+
ecrClient = fipsClient
133+
}
134+
return ecrClient
135+
}
136+
119137
func pushImage(c *cli.Context, rdwr config.ReadWriter, dockerClient dockerclient.Client, ecrClient ecrclient.Client, stsClient stsclient.Client) error {
120138
registryID := c.String(flags.RegistryIdFlag)
139+
121140
args := c.Args()
122141

123142
if len(args) != 1 {
@@ -253,12 +272,12 @@ func listImagesContent(w *tabwriter.Writer, info imageInfo, count int) {
253272

254273
func printImageRow(w io.Writer, info imageInfo) {
255274
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t\n",
256-
info.RepositoryName,
257-
info.Tag,
258-
info.ImageDigest,
259-
info.PushedAt,
260-
info.Size,
261-
)
275+
info.RepositoryName,
276+
info.Tag,
277+
info.ImageDigest,
278+
info.PushedAt,
279+
info.Size,
280+
)
262281
}
263282

264283
func getTagStatus(c *cli.Context) string {
@@ -297,17 +316,15 @@ func getECRAuth(registryURI string, registryID string,
297316
return ecrClient.GetAuthorizationToken(registryURI)
298317
}
299318

300-
func splitImageName(image string, seperatorRegExp string,
301-
format string) (registry string, repository string, tag string, err error) {
302-
319+
func splitImageName(image string, seperatorRegExp string, format string) (registry string, repository string, tag string, err error) {
303320
re := regexp.MustCompile(
304-
`^(?:((?:[a-zA-Z0-9][a-zA-Z0-9-_]*)\.dkr\.ecr\.[a-zA-Z0-9\-_]+\.amazonaws\.com(?:\.cn)?)/)?` + // repository uri (Optional)
305-
`([0-9a-z\-_/]+)` + // repository
306-
`(?:` + seperatorRegExp + `([0-9A-Za-z_.\-:]+))?$`) // tag (Optional)
307-
matches := re.FindStringSubmatch(image)
308-
if len(matches) == 0 {
309-
return "", "", "", fmt.Errorf("Please specify the image name in the correct format [%s]", format)
310-
}
321+
`^(?:((?:[a-zA-Z0-9][a-zA-Z0-9-_]*)\.dkr\.ecr(\-fips)?\.[a-zA-Z0-9\-_]+\.amazonaws\.com(?:\.cn)?)/)?` + // registry uri (Optional)
322+
`([0-9a-z\-_/]+)` + // repository
323+
`(?:` + seperatorRegExp + `([0-9A-Za-z_.\-:]+))?$`) // tag or sha (Optional)
324+
matches := re.FindStringSubmatch(image)
325+
if len(matches) == 0 {
326+
return "", "", "", fmt.Errorf("Please specify the image name in the correct format [%s]", format)
327+
}
311328

312-
return matches[1], matches[2], matches[3], nil
313-
}
329+
return matches[1], matches[3], matches[4], nil
330+
}

0 commit comments

Comments
 (0)