🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🏦 धडा 10 — ECR सेटअप: बँकेचा locker भाड्याने घेणे

📍 तुम्ही इथे आहात: 12 पैकी धडा 10 · मागे: lesson-09-registries · पुढे: lesson-11-push-pull-lifecycle

🔗 AWS शी संबंध: IAM → ECR. ECR authentication हा IAM चा प्रश्न आहे — AWS शाळेचा धडा 05 (मशीनच्या ओळखी) हा या धड्याचा दुसरा अर्धा भाग आहे.

📦 या ब्रँचमध्ये काय आहे

धडे 01–09, आणि त्याशिवाय: तुमची खाजगी ECR repository बनवणे आणि तिची दोन-किल्ल्यांची security समजून घेणे. खऱ्या files:

ecr/ecr.tf — Terraform code च्या रूपातला locker (immutable tags, scan-on-push)
ecr/lifecycle-policy.json — सफाई कर्मचाऱ्याचे नियम (धडा 11 समजावतो)

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

Docker Hub हे सार्वजनिक गोदाम आहे — node:20-alpine साठी ठीक, पण तुमच्या कंपनीच्या जेवणासाठी चुकीचे. तुम्हाला बँकेतला locker 🏦 हवा: खाजगी, पहाऱ्यातला, तुमचा. आत जाताना दोन तपासण्या होतात, आणि लोक त्या नेहमी गोंधळतात:

मुळात तुम्ही बँकेचे ग्राहक आहात का? 🪪 ते म्हणजे IAM — तुमची AWS ओळख आणि तिच्या परवानग्या (ecr:* actions). AWS credentials नाहीत, तर बोलणेच नाही. हे दीर्घकाळ टिकणारे असते आणि एकदाच सेट केले जाते.
दिवसाचा पास 🎫 — ग्राहक असलात तरी locker room ला ताजे तिकीट हवे: aws ecr get-login-password एक token छापते जो 12 तास वैध असतो, आणि तो तुम्ही docker login ला देता. उद्या? नवे तिकीट. (म्हणूनच CI pipelines प्रत्येक run वर login करतात — k8s कोर्समधला CircleCI job नेमके हेच करत होता ते आठवा.)

आणि locker भाड्याने कसा घ्यायचा? सर्वोत्तम उत्तर: code म्हणून — ecr/ecr.tf तो जाहीर करते (IMMUTABLE tags सह: एकदा चिकटवलेले लेबल शांतपणे दुसऱ्या डब्यावर पुन्हा कधीच चिकटवता येत नाही — hygiene नियम #1 बँकच स्वतः लागू करते 🏷️🔒).

🗺️ आकृती

flowchart LR
    tf["🏗️ terraform apply<br/>ecr/ecr.tf - rent once"]
    subgraph aws["☁️ AWS"]
        repo["🏦 ECR repo: hello-school<br/>private · IMMUTABLE tags<br/>🛡️ scan on push"]
        iam["🪪 IAM<br/>who is a customer at all"]
    end
    you["🧑‍💻 you / CI"]
    pass["🎫 12-hour day pass<br/>aws ecr get-login-password"]
    tf -->|"1"| repo
    you -->|"2 identity checked"| iam
    you -->|"3 fresh ticket"| pass -->|"docker login"| repo

❓ काय

ECR repository मध्ये एका ॲपच्या images असतात (कप्पा). पत्ता: ACCOUNT_ID.dkr.ecr.REGION.amazonaws.com/hello-school — region हा तुमच्या locker च्या रस्त्याच्या पत्त्याचाच भाग आहे.
image_tag_mutability = "IMMUTABLE" — v1 दोनदा push केल्यास अपयश येते. Tags विश्वासार्ह होतात; rollbacks प्रामाणिक होतात.
scan_on_push = true — बँक येणाऱ्या प्रत्येक डब्याचा X-ray काढते (धडा 12).
खर्च: storage ~$0.10/GB-month, खाजगी repos स्वतः फुकट. धडा 07 च्या लहान images + धडा 11 च्या सफाई कर्मचाऱ्यासह: काही पैसे.

🧠 Authentication चा प्रवाह, स्पष्टपणे

Developer
   ↓  AWS IAM credentials (SSO / CLI profile / role)
ECR authentication  (aws ecr get-login-password → a 12-hour token)
   ↓
Docker credential / token  (docker login)
   ↓
docker push
   ↓
ECR repository

ECR authentication हा IAM चा प्रश्न आहे. Docker फक्त token वाहून नेतो; तुम्ही push किंवा pull करू शकता की नाही हे IAM policies ठरवतात.

"कोण" चे तीन प्रकार:

Human developer   → AWS CLI / SSO credentials  → temporary ECR token
CI pipeline       → OIDC → assumes an IAM role → temporary ECR token   (no stored keys)
EKS nodes         → node/instance role → pull permission             (no login step at all)

हेच AWS → Docker → Kubernetes नाते एका तक्त्यात: ओळख AWS कडून येते, artifact Docker कडून, pull Kubernetes कडून.

🤔 का

खाजगी images ना खाजगी, IAM च्या पहाऱ्यातले, region-local गोदाम लागते — आणि EKS nodes ECR वरून स्वतःच्या IAM role ने pull करतात, कुठेही passwords नाहीत (बँक स्वतःच्या कर्मचाऱ्यांना ओळखते). तो code म्हणून भाड्याने घेतल्याने भाग 2 ही trilogy जे सांगते त्याच्याशी सुसंगत राहतो: infrastructure जाहीर केलेले, versioned, review करता येणारे.

🧪 करून पाहा (AWS account + configure केलेले AWS CLI लागते)

# rent the locker — pick ONE of the two:
cd ecr && terraform init && terraform apply          # as code (recommended)
# or the one-liner:
aws ecr create-repository --repository-name hello-school \
  --image-tag-mutability IMMUTABLE \
  --image-scanning-configuration scanOnPush=true

# your locker's address (save it — lesson 11 uses it constantly):
aws ecr describe-repositories --repository-names hello-school \
  --query 'repositories[0].repositoryUri' --output text
# → 123456789012.dkr.ecr.ap-south-1.amazonaws.com/hello-school

# the day pass 🎫:
aws ecr get-login-password --region ap-south-1 \
  | docker login --username AWS --password-stdin \
    123456789012.dkr.ecr.ap-south-1.amazonaws.com     # "Login Succeeded"

⚠️ नेहमीच्या चुका

ECR authentication ≠ Docker Hub login — username/password नाही, IAM ने दिलेला 12 तासांचा token
access IAM permissions (ecr:* actions) नियंत्रित करतात; फक्त token काहीच उघडत नाही
CI settings मध्ये कायमस्वरूपी access keys — OIDC → role वापरा (AWS शाळा, धडा 05)
token संपला — 12 तासांनंतर "no basic auth credentials" येणे सामान्य आहे, पुन्हा login करा

⏭️ पुढे

Locker भाड्याने घेतला, पास हातात आहे. आता प्रत्यक्ष त्यात डबे ठेवायची वेळ — tag, push, pull — आणि तो नीटनेटका ठेवणाऱ्या सफाई कर्मचाऱ्याची ओळख करून घ्या.

git checkout lesson-11-push-pull-lifecycle

🏦 Lesson 10 — ECR setup: renting the bank locker

📍 You are here: Lesson 10 of 12 · Previous: lesson-09-registries · Next: lesson-11-push-pull-lifecycle

🔗 AWS connection: IAM → ECR. ECR authentication is an IAM problem — the AWS school's lesson 05 (machine identities) is the other half of this lesson.

📦 What's in this branch

Lessons 01–09, plus: creating your private ECR repository and understanding its two-key security. Real files:

ecr/ecr.tf — the locker as Terraform code (immutable tags, scan-on-push)
ecr/lifecycle-policy.json — the janitor rules (lesson 11 explains)

🧒 Explain like I'm 5

Docker Hub is a public warehouse — fine for node:20-alpine, wrong for your company's lunches. You want a locker at the bank 🏦: private, guarded, yours. Getting in involves TWO checks, and people always confuse them:

Are you a bank customer at all? 🪪 That's IAM — your AWS identity and its permissions (ecr:* actions). No AWS credentials, no conversation. This is long-lived and set up once.
The day pass 🎫 — even as a customer, the locker room wants a fresh ticket: aws ecr get-login-password prints a token that's valid for 12 hours, and you feed it to docker login. Tomorrow? New ticket. (This is why CI pipelines log in every run — remember the k8s course's CircleCI job doing exactly this.)

And how do you rent the locker? Best answer: as code — ecr/ecr.tf declares it (with IMMUTABLE tags: a label, once glued, can never be silently re-glued onto a different box — hygiene rule #1 enforced by the bank itself 🏷️🔒).

🗺️ Diagram

flowchart LR
    tf["🏗️ terraform apply<br/>ecr/ecr.tf - rent once"]
    subgraph aws["☁️ AWS"]
        repo["🏦 ECR repo: hello-school<br/>private · IMMUTABLE tags<br/>🛡️ scan on push"]
        iam["🪪 IAM<br/>who is a customer at all"]
    end
    you["🧑‍💻 you / CI"]
    pass["🎫 12-hour day pass<br/>aws ecr get-login-password"]
    tf -->|"1"| repo
    you -->|"2 identity checked"| iam
    you -->|"3 fresh ticket"| pass -->|"docker login"| repo

❓ What

An ECR repository holds one app's images (the shelf). Address: ACCOUNT_ID.dkr.ecr.REGION.amazonaws.com/hello-school — the region is part of your locker's street address.
image_tag_mutability = "IMMUTABLE" — pushing v1 twice fails. Tags become trustworthy; rollbacks become honest.
scan_on_push = true — the bank X-rays every box on arrival (lesson 12).
Cost: storage ~$0.10/GB-month, private repos themselves free. With lesson 07's small images + lesson 11's janitor: pennies.

🧠 The authentication flow, made explicit

Developer
   ↓  AWS IAM credentials (SSO / CLI profile / role)
ECR authentication  (aws ecr get-login-password → a 12-hour token)
   ↓
Docker credential / token  (docker login)
   ↓
docker push
   ↓
ECR repository

ECR authentication is an IAM problem. Docker only carries the token; whether you may push or pull at all is decided by IAM policies.

Three kinds of "who":

Human developer   → AWS CLI / SSO credentials  → temporary ECR token
CI pipeline       → OIDC → assumes an IAM role → temporary ECR token   (no stored keys)
EKS nodes         → node/instance role → pull permission             (no login step at all)

That is the AWS → Docker → Kubernetes relationship in one table: identity comes from AWS, the artifact from Docker, the pull from Kubernetes.

🤔 Why

Private images need a private, IAM-guarded, region-local warehouse — and EKS nodes pull from ECR with their own IAM role, no passwords anywhere (the bank recognizes its own staff). Renting it as code keeps Part 2 consistent with everything this trilogy preaches: infrastructure declared, versioned, reviewable.

🧪 Try it (needs an AWS account + AWS CLI configured)

# rent the locker — pick ONE of the two:
cd ecr && terraform init && terraform apply          # as code (recommended)
# or the one-liner:
aws ecr create-repository --repository-name hello-school \
  --image-tag-mutability IMMUTABLE \
  --image-scanning-configuration scanOnPush=true

# your locker's address (save it — lesson 11 uses it constantly):
aws ecr describe-repositories --repository-names hello-school \
  --query 'repositories[0].repositoryUri' --output text
# → 123456789012.dkr.ecr.ap-south-1.amazonaws.com/hello-school

# the day pass 🎫:
aws ecr get-login-password --region ap-south-1 \
  | docker login --username AWS --password-stdin \
    123456789012.dkr.ecr.ap-south-1.amazonaws.com     # "Login Succeeded"

⚠️ Common mistakes

ECR authentication ≠ Docker Hub login — no username/password, a 12-hour IAM-issued token
IAM permissions (ecr:* actions) control access; the token alone opens nothing
permanent access keys in CI settings — use OIDC → role (AWS school, lesson 05)
the token expired — "no basic auth credentials" after 12 hours is normal, log in again

⏭️ Next

Locker rented, pass in hand. Time to actually file boxes in it — tag, push, pull — and meet the janitor who keeps it tidy.

git checkout lesson-11-push-pull-lifecycle

← Previousregistries Next →push pull lifecycle

This page is the lesson's README from the lesson-10-ecr-setup branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.