feat: add aws `ecr_repository_policy` resource

pkg/iac/terraform/state/terraform_state_reader_test.go

@@ -201,6 +201,7 @@ func TestTerraformStateReader_AWS_Resources(t *testing.T) {
 		{name: "Classic load balancer", dirName: "aws_elb", wantErr: false},
 		{name: "ElastiCache Cluster", dirName: "aws_elasticache_cluster", wantErr: false},
 		{name: "IAM Group", dirName: "aws_iam_group", wantErr: false},
+		{name: "ECR Repository Policy", dirName: "aws_ecr_repository_policy", wantErr: false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

pkg/iac/terraform/state/test/aws_ecr_repository_policy/results.golden.json

@@ -0,0 +1,12 @@
+[
+ {
+  "Id": "bar",
+  "Type": "aws_ecr_repository_policy",
+  "Attrs": {
+   "id": "bar",
+   "policy": "{\n  \"Version\" : \"2008-10-17\",\n  \"Statement\" : [ {\n    \"Sid\" : \"new policy\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : \"*\",\n    \"Action\" : [ \"ecr:GetDownloadUrlForLayer\", \"ecr:BatchGetImage\", \"ecr:BatchCheckLayerAvailability\", \"ecr:PutImage\", \"ecr:InitiateLayerUpload\", \"ecr:UploadLayerPart\", \"ecr:CompleteLayerUpload\", \"ecr:DescribeRepositories\", \"ecr:GetRepositoryPolicy\", \"ecr:ListImages\", \"ecr:DeleteRepository\", \"ecr:BatchDeleteImage\", \"ecr:SetRepositoryPolicy\", \"ecr:DeleteRepositoryPolicy\" ]\n  } ]\n}",
+   "registry_id": "586583619100",
+   "repository": "bar"
+  }
+ }
+]

pkg/iac/terraform/state/test/aws_ecr_repository_policy/terraform.tfstate

@@ -0,0 +1,31 @@
+{
+  "version": 4,
+  "terraform_version": "0.14.6",
+  "serial": 50,
+  "lineage": "49d84423-0f98-9ac4-ffe0-84ef3126d36f",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "aws_ecr_repository_policy",
+      "name": "foopolicy",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "bar",
+            "policy": "{\n  \"Version\" : \"2008-10-17\",\n  \"Statement\" : [ {\n    \"Sid\" : \"new policy\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : \"*\",\n    \"Action\" : [ \"ecr:GetDownloadUrlForLayer\", \"ecr:BatchGetImage\", \"ecr:BatchCheckLayerAvailability\", \"ecr:PutImage\", \"ecr:InitiateLayerUpload\", \"ecr:UploadLayerPart\", \"ecr:CompleteLayerUpload\", \"ecr:DescribeRepositories\", \"ecr:GetRepositoryPolicy\", \"ecr:ListImages\", \"ecr:DeleteRepository\", \"ecr:BatchDeleteImage\", \"ecr:SetRepositoryPolicy\", \"ecr:DeleteRepositoryPolicy\" ]\n  } ]\n}",
+            "registry_id": "586583619100",
+            "repository": "bar"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "aws_ecr_repository.foo"
+          ]
+        }
+      ]
+    }
+  ]
+}

pkg/remote/aws/ecr_repository_policy_enumerator.go

@@ -0,0 +1,51 @@
+package aws
+
+import (
+	"github.com/snyk/driftctl/pkg/remote/aws/repository"
+	remoteerror "github.com/snyk/driftctl/pkg/remote/error"
+	"github.com/snyk/driftctl/pkg/resource"
+	"github.com/snyk/driftctl/pkg/resource/aws"
+)
+
+type ECRRepositoryPolicyEnumerator struct {
+	repository repository.ECRRepository
+	factory    resource.ResourceFactory
+}
+
+func NewECRRepositoryPolicyEnumerator(repo repository.ECRRepository, factory resource.ResourceFactory) *ECRRepositoryPolicyEnumerator {
+	return &ECRRepositoryPolicyEnumerator{
+		repository: repo,
+		factory:    factory,
+	}
+}
+
+func (e *ECRRepositoryPolicyEnumerator) SupportedType() resource.ResourceType {
+	return aws.AwsEcrRepositoryPolicyResourceType
+}
+
+func (e *ECRRepositoryPolicyEnumerator) Enumerate() ([]*resource.Resource, error) {
+	repos, err := e.repository.ListAllRepositories()
+	if err != nil {
+		return nil, remoteerror.NewResourceListingErrorWithType(err, string(e.SupportedType()), aws.AwsEcrRepositoryResourceType)
+	}
+
+	results := make([]*resource.Resource, 0, len(repos))
+
+	for _, repo := range repos {
+		repoOutput, err := e.repository.GetRepositoryPolicy(repo)
+		if err != nil {
+			return nil, remoteerror.NewResourceListingError(err, string(e.SupportedType()))
+		}
+
+		results = append(
+			results,
+			e.factory.CreateAbstractResource(
+				string(e.SupportedType()),
+				*repoOutput.RepositoryName,
+				map[string]interface{}{},
+			),
+		)
+	}
+
+	return results, err
+}

pkg/remote/aws/init.go

@@ -191,6 +191,7 @@ func Init(version string, alerter *alerter.Alerter,
 
 	remoteLibrary.AddEnumerator(NewECRRepositoryEnumerator(ecrRepository, factory))
 	remoteLibrary.AddDetailsFetcher(aws.AwsEcrRepositoryResourceType, common.NewGenericDetailsFetcher(aws.AwsEcrRepositoryResourceType, provider, deserializer))
+	remoteLibrary.AddEnumerator(NewECRRepositoryPolicyEnumerator(ecrRepository, factory))
 
 	remoteLibrary.AddEnumerator(NewRDSClusterEnumerator(rdsRepository, factory))
 	remoteLibrary.AddDetailsFetcher(aws.AwsRDSClusterResourceType, common.NewGenericDetailsFetcher(aws.AwsRDSClusterResourceType, provider, deserializer))

pkg/remote/aws/repository/ecr_repository.go

@@ -1,6 +1,8 @@
 package repository
 
 import (
+	"fmt"
+
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	"github.com/aws/aws-sdk-go/service/ecr/ecriface"
@@ -9,6 +11,7 @@ import (
 
 type ECRRepository interface {
 	ListAllRepositories() ([]*ecr.Repository, error)
+	GetRepositoryPolicy(*ecr.Repository) (*ecr.GetRepositoryPolicyOutput, error)
 }
 
 type ecrRepository struct {
@@ -41,3 +44,23 @@ func (r *ecrRepository) ListAllRepositories() ([]*ecr.Repository, error) {
 	r.cache.Put("ecrListAllRepositories", repositories)
 	return repositories, nil
 }
+
+func (r *ecrRepository) GetRepositoryPolicy(repo *ecr.Repository) (*ecr.GetRepositoryPolicyOutput, error) {
+	cacheKey := fmt.Sprintf("ecrListAllRepositoriesGetRepositoryPolicy_%s_%s", *repo.RegistryId, *repo.RepositoryName)
+	if v := r.cache.Get(cacheKey); v != nil {
+		return v.(*ecr.GetRepositoryPolicyOutput), nil
+	}
+
+	var repositoryPolicyInput *ecr.GetRepositoryPolicyInput = &ecr.GetRepositoryPolicyInput{
+		RegistryId:     repo.RegistryId,
+		RepositoryName: repo.RepositoryName,
+	}
+
+	repoOutput, err := r.client.GetRepositoryPolicy(repositoryPolicyInput)
+	if err != nil {
+		return nil, err
+	}
+
+	r.cache.Put(cacheKey, repoOutput)
+	return repoOutput, nil
+}

pkg/remote/aws/repository/ecr_repository_test.go

@@ -1,10 +1,12 @@
 package repository
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/ecr"
+	"github.com/pkg/errors"
 	"github.com/snyk/driftctl/pkg/remote/cache"
 	awstest "github.com/snyk/driftctl/test/aws"
 
@@ -88,3 +90,82 @@ func Test_ecrRepository_ListAllRepositories(t *testing.T) {
 		})
 	}
 }
+
+func Test_ecrRepository_GetRepositoryPolicy(t *testing.T) {
+	dummyError := errors.New("this is an error")
+
+	tests := []struct {
+		name    string
+		mocks   func(client *awstest.MockFakeECR)
+		want    *ecr.GetRepositoryPolicyOutput
+		wantErr error
+	}{
+		{
+			name: "Get repository policy",
+			mocks: func(client *awstest.MockFakeECR) {
+				client.On("GetRepositoryPolicy",
+					&ecr.GetRepositoryPolicyInput{
+						RegistryId:     aws.String("1"),
+						RepositoryName: aws.String("2"),
+					},
+				).Return(&ecr.GetRepositoryPolicyOutput{
+					RegistryId:     aws.String("1"),
+					RepositoryName: aws.String("2"),
+				}, nil).Once()
+			},
+			want: &ecr.GetRepositoryPolicyOutput{
+				RegistryId:     aws.String("1"),
+				RepositoryName: aws.String("2"),
+			},
+		},
+		{
+			name: "Get repository policy error",
+			mocks: func(client *awstest.MockFakeECR) {
+				client.On("GetRepositoryPolicy",
+					&ecr.GetRepositoryPolicyInput{
+						RegistryId:     aws.String("1"),
+						RepositoryName: aws.String("2"),
+					},
+				).Return(nil, dummyError).Once()
+			},
+			wantErr: dummyError,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := cache.New(1)
+			client := awstest.MockFakeECR{}
+			tt.mocks(&client)
+			r := &ecrRepository{
+				client: &client,
+				cache:  store,
+			}
+
+			repo := &ecr.Repository{
+				RegistryId:     aws.String("1"),
+				RepositoryName: aws.String("2"),
+			}
+
+			got, err := r.GetRepositoryPolicy(repo)
+			assert.Equal(t, tt.wantErr, err)
+
+			if err == nil {
+				// Check that results were cached
+				cachedData, err := r.GetRepositoryPolicy(repo)
+				assert.NoError(t, err)
+				assert.Equal(t, got, cachedData)
+				cacheKey := fmt.Sprintf("ecrListAllRepositoriesGetRepositoryPolicy_%s_%s", *repo.RegistryId, *repo.RepositoryName)
+				assert.IsType(t, &ecr.GetRepositoryPolicyOutput{}, store.Get(cacheKey))
+			}
+
+			changelog, err := diff.Diff(got, tt.want)
+			assert.Nil(t, err)
+			if len(changelog) > 0 {
+				for _, change := range changelog {
+					t.Errorf("%s: %s -> %s", strings.Join(change.Path, "."), change.From, change.To)
+				}
+				t.Fail()
+			}
+		})
+	}
+}

pkg/remote/aws/repository/mock_ECRRepository.go

@@ -1,4 +1,4 @@
-// Code generated by mockery v1.0.0. DO NOT EDIT.
+// Code generated by mockery v2.10.0. DO NOT EDIT.
 
 package repository
 
@@ -7,11 +7,34 @@ import (
 	mock "github.com/stretchr/testify/mock"
 )
 
-// MockECRRepository is an autogenerated mock type for the MockECRRepository type
+// MockECRRepository is an autogenerated mock type for the ECRRepository type
 type MockECRRepository struct {
 	mock.Mock
 }
 
+// GetRepositoryPolicy provides a mock function with given fields: _a0
+func (_m *MockECRRepository) GetRepositoryPolicy(_a0 *ecr.Repository) (*ecr.GetRepositoryPolicyOutput, error) {
+	ret := _m.Called(_a0)
+
+	var r0 *ecr.GetRepositoryPolicyOutput
+	if rf, ok := ret.Get(0).(func(*ecr.Repository) *ecr.GetRepositoryPolicyOutput); ok {
+		r0 = rf(_a0)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*ecr.GetRepositoryPolicyOutput)
+		}
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(*ecr.Repository) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // ListAllRepositories provides a mock function with given fields:
 func (_m *MockECRRepository) ListAllRepositories() ([]*ecr.Repository, error) {
 	ret := _m.Called()

pkg/remote/aws_ecr_scanner_test.go

@@ -125,3 +125,69 @@ func TestECRRepository(t *testing.T) {
 		})
 	}
 }
+
+func TestECRRepositoryPolicy(t *testing.T) {
+	tests := []struct {
+		test           string
+		mocks          func(*repository.MockECRRepository, *mocks.AlerterInterface)
+		assertExpected func(t *testing.T, got []*resource.Resource)
+		err            error
+	}{
+		{
+			test: "single repository policy",
+			mocks: func(client *repository.MockECRRepository, alerter *mocks.AlerterInterface) {
+				client.On("ListAllRepositories").Return([]*ecr.Repository{
+					{RepositoryName: awssdk.String("test_ecr_repo_policy")},
+				}, nil)
+				client.On("GetRepositoryPolicy", &ecr.Repository{
+					RepositoryName: awssdk.String("test_ecr_repo_policy"),
+				}).Return(&ecr.GetRepositoryPolicyOutput{
+					RegistryId:     awssdk.String("1"),
+					RepositoryName: awssdk.String("test_ecr_repo_policy"),
+				}, nil)
+			},
+			assertExpected: func(t *testing.T, got []*resource.Resource) {
+				assert.Len(t, got, 1)
+
+				assert.Equal(t, got[0].ResourceId(), "test_ecr_repo_policy")
+			},
+			err: nil,
+		},
+	}
+
+	providerVersion := "3.19.0"
+	schemaRepository := testresource.InitFakeSchemaRepository("aws", providerVersion)
+	resourceaws.InitResourcesMetadata(schemaRepository)
+	factory := terraform.NewTerraformResourceFactory(schemaRepository)
+
+	for _, c := range tests {
+		t.Run(c.test, func(tt *testing.T) {
+			scanOptions := ScannerOptions{}
+			remoteLibrary := common.NewRemoteLibrary()
+
+			// Initialize mocks
+			alerter := &mocks.AlerterInterface{}
+			fakeRepo := &repository.MockECRRepository{}
+			c.mocks(fakeRepo, alerter)
+
+			var repo repository.ECRRepository = fakeRepo
+
+			remoteLibrary.AddEnumerator(aws.NewECRRepositoryPolicyEnumerator(repo, factory))
+
+			testFilter := &filter.MockFilter{}
+			testFilter.On("IsTypeIgnored", mock.Anything).Return(false)
+
+			s := NewScanner(remoteLibrary, alerter, scanOptions, testFilter)
+			got, err := s.Resources()
+			assert.Equal(tt, err, c.err)
+			if err != nil {
+				return
+			}
+
+			c.assertExpected(tt, got)
+			alerter.AssertExpectations(tt)
+			fakeRepo.AssertExpectations(tt)
+			testFilter.AssertExpectations(tt)
+		})
+	}
+}

pkg/resource/aws/aws_ecr_repository_policy.go

@@ -0,0 +1,3 @@
+package aws
+
+const AwsEcrRepositoryPolicyResourceType = "aws_ecr_repository_policy"

pkg/resource/aws/aws_ecr_repository_policy_test.go

@@ -0,0 +1,30 @@
+package aws_test
+
+import (
+	"testing"
+
+	"github.com/snyk/driftctl/test"
+	"github.com/snyk/driftctl/test/acceptance"
+)
+
+func TestAcc_AWS_ECRRepositoryPolicy(t *testing.T) {
+	acceptance.Run(t, acceptance.AccTestCase{
+		TerraformVersion: "0.15.5",
+		Paths:            []string{"./testdata/acc/aws_ecr_repository_policy_test"},
+		Args:             []string{"scan"},
+		Checks: []acceptance.AccCheck{
+			{
+				Env: map[string]string{
+					"AWS_REGION": "us-east-1",
+				},
+				Check: func(result *test.ScanResult, stdout string, err error) {
+					if err != nil {
+						t.Fatal(err)
+					}
+					result.AssertInfrastructureIsInSync()
+					result.AssertManagedCount(1)
+				},
+			},
+		},
+	})
+}

pkg/resource/aws/metadata_test.go

@@ -116,6 +116,7 @@ func TestAWS_Metadata_Flags(t *testing.T) {
 		AwsLoadBalancerListenerResourceType:            {},
 		AwsApplicationLoadBalancerListenerResourceType: {},
 		AwsIamGroupResourceType:                        {},
+		AwsEcrRepositoryPolicyResourceType:             {},
 	}
 
 	schemaRepository := testresource.InitFakeSchemaRepository(tf.AWS, "3.19.0")

pkg/resource/aws/testdata/acc/aws_ecr_repository_policy/.driftignore

@@ -0,0 +1,2 @@
+*
+!aws_ecr_repository_policy

pkg/resource/aws/testdata/acc/aws_ecr_repository_policy/.terraform.lock.hcl

@@ -0,0 +1,20 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "3.19.0"
+  constraints = "3.19.0"
+  hashes = [
+    "h1:xur9tF49NgsovNnmwmBR8RdpN8Fcg1TD4CKQPJD6n1A=",
+    "zh:185a5259153eb9ee4699d4be43b3d509386b473683392034319beee97d470c3b",
+    "zh:2d9a0a01f93e8d16539d835c02b8b6e1927b7685f4076e96cb07f7dd6944bc6c",
+    "zh:703f6da36b1b5f3497baa38fccaa7765fb8a2b6440344e4c97172516b49437dd",
+    "zh:770855565462abadbbddd98cb357d2f1a8f30f68a358cb37cbd5c072cb15b377",
+    "zh:8008db43149fe4345301f81e15e6d9ddb47aa5e7a31648f9b290af96ad86e92a",
+    "zh:8cdd27d375da6dcb7687f1fed126b7c04efce1671066802ee876dbbc9c66ec79",
+    "zh:be22ae185005690d1a017c1b909e0d80ab567e239b4f06ecacdba85080667c1c",
+    "zh:d2d02e72dbd80f607636cd6237a6c862897caabc635c7b50c0cb243d11246723",
+    "zh:d8f125b66a1eda2555c0f9bbdf12036a5f8d073499a22ca9e4812b68067fea31",
+    "zh:f5a98024c64d5d2973ff15b093725a074c0cb4afde07ef32c542e69f17ac90bc",
+  ]
+}

pkg/resource/aws/testdata/acc/aws_ecr_repository_policy/terraform.tf

@@ -0,0 +1,46 @@
+provider "aws" {
+  region = "eu-west-1"
+}
+
+terraform {
+  required_providers {
+    aws = "3.19.0"
+  }
+}
+
+resource "aws_ecr_repository" "foo" {
+  name = "bar"
+}
+
+resource "aws_ecr_repository_policy" "foopolicy" {
+  repository = aws_ecr_repository.foo.name
+
+  policy = <<EOF
+{
+    "Version": "2008-10-17",
+    "Statement": [
+        {
+            "Sid": "new policy",
+            "Effect": "Allow",
+            "Principal": "*",
+            "Action": [
+                "ecr:GetDownloadUrlForLayer",
+                "ecr:BatchGetImage",
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:PutImage",
+                "ecr:InitiateLayerUpload",
+                "ecr:UploadLayerPart",
+                "ecr:CompleteLayerUpload",
+                "ecr:DescribeRepositories",
+                "ecr:GetRepositoryPolicy",
+                "ecr:ListImages",
+                "ecr:DeleteRepository",
+                "ecr:BatchDeleteImage",
+                "ecr:SetRepositoryPolicy",
+                "ecr:DeleteRepositoryPolicy"
+            ]
+        }
+    ]
+}
+EOF
+}

pkg/resource/resource_types.go

@@ -34,6 +34,7 @@ var supportedTypes = map[string]ResourceTypeMeta{
 	}},
 	"aws_ebs_encryption_by_default": {},
 	"aws_ecr_repository":            {},
+	"aws_ecr_repository_policy":     {},
 	"aws_eip": {children: []ResourceType{
 		"aws_eip_association",
 	}},