bitovi/Deploy an ECR Registry to AWS
Deploys an Amazon hosted ECR Registry to store Docker and OCI images and artifacts.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Nov 21, 2025
- License
- MIT
Pinned Snippet
uses: bitovi/github-actions-deploy-aws-ecr-registry@197e165e2c1774b54d2be03549883f3235abe846 # v0.1.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| bitops_code_only | Will run only the generation phase of BitOps, where the Terraform and Ansible code is built. | no | — |
| bitops_code_store | Store BitOps code as a GitHub artifact | no | false |
| aws_access_key_id | AWS access key ID | yes | — |
| aws_secret_access_key | AWS secret access key | yes | — |
| aws_session_token | AWS session token | no | — |
| aws_default_region | AWS default region | no | us-east-1 |
| aws_resource_identifier | Set to override the AWS resource identifier for the deployment. Defaults to `${org}-{repo}-{branch}`. Use with destroy to destroy specific resources. | no | — |
| aws_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| tf_stack_destroy | Set to "true" to Destroy the stack through Terraform. | no | — |
| tf_state_file_name | Change this to be anything you want to. Carefull to be consistent here. A missing file could trigger recreation, or stepping over destruction of non-defined objects. | no | — |
| tf_state_file_name_append | Append a string to the tf-state-file. Setting this to `unique` will generate `tf-state-aws-unique`. Can co-exist with the tf_state_file_name variable. | no | — |
| tf_state_bucket | AWS S3 bucket to use for Terraform state. Defaults to `${org}-${repo}-{branch}-tf-state` | no | — |
| tf_state_bucket_destroy | Force purge and deletion of S3 bucket defined. Any file contained there will be destroyed. `tf_stack_destroy` must also be `true` | no | — |
| aws_ecr_repo_create | Determines whether a repository will be created | no | true |
| aws_ecr_repo_type | The type of repository to create. Either `public` or `private`. Defaults to `private`. | no | — |
| aws_ecr_repo_name | The name of the repository. If none, will use the default resource-identifier. | no | — |
| aws_ecr_repo_mutable | The tag mutability setting for the repository. Set this to true if `MUTABLE`. Defaults to false, so `IMMUTABLE` | no | — |
| aws_ecr_repo_encryption_type | The encryption type for the repository. Must be one of: `KMS` or `AES256`. Defaults to `AES256` | no | — |
| aws_ecr_repo_encryption_key_arn | The ARN of the KMS key to use when encryption_type is `KMS`. If not specified, uses the default AWS managed key for ECR | no | — |
| aws_ecr_repo_force_destroy | If `true`, will delete the repository even if it contains images. Defaults to `false` | no | — |
| aws_ecr_repo_image_scan | Indicates whether images are scanned after being pushed to the repository (`true`) (default) or not scanned (`false`) | no | — |
| aws_ecr_registry_scan_rule | One or multiple blocks specifying scanning rules to determine which repository filters are used and at what frequency scanning will occur. Use [] | no | — |
| aws_ecr_registry_pull_through_cache_rules | List of pull through cache rules to create. Use map(map(string)). | no | — |
| aws_ecr_registry_scan_config | Scanning type to set for the registry. Can be either `ENHANCED` or `BASIC`. Defaults to null. | no | — |
| aws_ecr_registry_replication_rules_input | The replication rules for a replication configuration. A maximum of 10 are allowed. Defaults to `[]`. | no | — |
| aws_ecr_repo_policy_attach | Determines whether a repository policy will be attached to the repository. Defaults to `true`. | no | — |
| aws_ecr_repo_policy_create | Determines whether a repository policy will be created. Defaults to `true`. | no | — |
| aws_ecr_repo_policy_input | The JSON policy to apply to the repository. If defined overrides the default policy | no | — |
| aws_ecr_repo_read_arn | The ARNs of the IAM users/roles that have read access to the repository. (Comma separated list) | no | — |
| aws_ecr_repo_write_arn | The ARNs of the IAM users/roles that have read/write access to the repository. (Comma separated list) | no | — |
| aws_ecr_repo_read_external_aws_account | The ARNs of the external AWS accounts that have read access to the repository | no | — |
| aws_ecr_repo_write_external_aws_account | The ARNs of the external AWS accounts that have write access to the repository | no | — |
| aws_ecr_repo_read_arn_lambda | The ARNs of the Lambda service roles that have read access to the repository. (Comma separated list) | no | — |
| aws_ecr_lifecycle_policy_input | The policy document. This is a JSON formatted string. See more details about [Policy Parameters](http://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html#lifecycle_policy_parameters) in the official AWS docs | no | — |
| aws_ecr_public_repo_catalog | Catalog data configuration for the repository. Defaults to `{}`. | no | — |
| aws_ecr_registry_policy_input | The policy document. This is a JSON formatted string | no | — |
| aws_ecr_additional_tags | A list of strings that will be added to created resources | no | — |
Outputs
| name | description |
|---|---|
| ecr_repository_url | ECR Repo URL |
| ecr_repository_arn | ECR Repo ARN |
| ecr_repository_registry_id | ECR Repo Registry ID |