kayako/drone-ecr repository overview

⁠Drone ECR

A Drone⁠ plugin to build and push the docker container to AWS ECR repository.

This plugin is based on official drone ECR plugin⁠. It adds a simple IAM assume-role auth layer on top of the official plugin to utilize cross account IAM roles.

⁠Usage

pipeline:
  push:
    image: kayako/drone-ecr:latest
    repo: 0123456789.dkr.ecr.us-east-1.amazonaws.com/awesome-app
    tags:
      - latest
      - ${DRONE_COMMIT:0:8}
      - build-${DRONE_BUILD_NUMBER}

The configuration above will

• assume IAM role arn:aws:iam::0123456789:role/ci in AWS account 0123456789
• Get ECR login details and login with Docker
• Build the container 0123456789.dkr.ecr.us-east-1.amazonaws.com/awesome-app
• Tag it as
  • latest
  • First 8 characters of commit SHA
  • build-DRONE_BUILD_NUMBER
• Push the container with all three tags to ECR repository

⁠Drone Configuration

This plugin indirectly extends the official docker docker image (DinD) and therefor requires elevated privileges. You must whitelist the plugin in Drone configuration to allow privileged execution. Add DRONE_ESCALATE=plugins/docker,plugins/gcr,kayako/drone-ecr environment variable in Drone server configuration and restart the server for changes to take effect.

⁠IAM Configuration

Create an IAM role in target AWS account and allow the CI account to assume the role.

⁠Plugin Configuration

Following environment variables can be configured:

To avoid writing identical pipeline steps for multiple environments and AWS accounts you can also provide only the repository name and omit the registry part. If the registry is not provided as part of the repo attribute the plugin will try to look up the AWS account number using current deployment target. Assuming that the current deployment target is develop, the plugin will attempt to look up account_number_develop variable and, if present, will use it to assume IAM role and rewrite the repository name with registry.

If the repo does not contain the registry and a suitable environment variable is also not present then the build will fail.

⁠Example

Assuming the build secret account_number_develop is set to 1234567890 and deployment target is develop, the configuration

pipeline:
  push:
    image: kayako/drone-ecr:latest
    repo: awesome-app
    region: us-west-2
    tags:
      - latest
      - ${DRONE_COMMIT:0:8}

will assume role is AWS account 1234567890 and push the container to 0123456789.dkr.ecr.us-west-2.amazonaws.com/awesome-app

⁠Notes

All the configuration options available in plugins/ecr container are supported.

⁠License