AWS.ECR reference

BatchCheckLayerAvailability

Source: src/AWS/ECR/BatchCheckLayerAvailability.ts

Runtime binding for ecr:BatchCheckLayerAvailability.

Checks whether image layers already exist in the bound repository — pushed clients call this before uploading to skip blobs the registry already has. Provide the implementation with Effect.provide(AWS.ECR.BatchCheckLayerAvailabilityHttp).

BatchCheckLayerAvailability: Pushing Images

const checkLayers = yield* AWS.ECR.BatchCheckLayerAvailability(repository);

const res = yield* checkLayers({ layerDigests: ["sha256:…"] });
const missing = res.layers?.filter((l) => l.layerAvailability === "UNAVAILABLE");

BatchDeleteImage

Source: src/AWS/ECR/BatchDeleteImage.ts

Runtime binding for ecr:BatchDeleteImage.

Deletes images (by tag or digest) from the bound repository. Missing images are reported in the response’s failures array rather than as an error, so deletion is naturally idempotent. Provide the implementation with Effect.provide(AWS.ECR.BatchDeleteImageHttp).

BatchDeleteImage: Deleting Images

const batchDeleteImage = yield* AWS.ECR.BatchDeleteImage(repository);

const res = yield* batchDeleteImage({ imageIds: [{ imageTag: "stale" }] });
console.log(res.imageIds?.length, "deleted");

BatchGetImage

Source: src/AWS/ECR/BatchGetImage.ts

Runtime binding for ecr:BatchGetImage.

Fetches image manifests from the bound repository — the read half of a registry pull, and the first step of re-tagging an image (BatchGetImage → PutImage with a new tag). Provide the implementation with Effect.provide(AWS.ECR.BatchGetImageHttp).

BatchGetImage: Pulling Images

const batchGetImage = yield* AWS.ECR.BatchGetImage(repository);

const res = yield* batchGetImage({ imageIds: [{ imageTag: "latest" }] });
const manifest = res.images?.[0]?.imageManifest;

CompleteLayerUpload

Source: src/AWS/ECR/CompleteLayerUpload.ts

Runtime binding for ecr:CompleteLayerUpload.

Seals an open layer upload in the bound repository; ECR verifies the uploaded bytes against the supplied sha256 digest. Provide the implementation with Effect.provide(AWS.ECR.CompleteLayerUploadHttp).

CompleteLayerUpload: Pushing Images

const completeUpload = yield* AWS.ECR.CompleteLayerUpload(repository);

yield* completeUpload({
  uploadId: uploadId!,
  layerDigests: [`sha256:${sha256HexOfBlob}`],
});

DescribeImages

Source: src/AWS/ECR/DescribeImages.ts

Runtime binding for ecr:DescribeImages.

Returns metadata (digest, tags, size, push time, scan status) about the images in the bound repository. Provide the implementation with Effect.provide(AWS.ECR.DescribeImagesHttp).

DescribeImages: Reading Images

const describeImages = yield* AWS.ECR.DescribeImages(repository);

const res = yield* describeImages({ imageIds: [{ imageTag: "latest" }] });
console.log(res.imageDetails?.[0]?.imageDigest);

DescribeImageScanFindings

Source: src/AWS/ECR/DescribeImageScanFindings.ts

Runtime binding for ecr:DescribeImageScanFindings.

Returns the vulnerability findings of the most recent scan of an image in the bound repository. Provide the implementation with Effect.provide(AWS.ECR.DescribeImageScanFindingsHttp).

DescribeImageScanFindings: Image Scanning

const describeScanFindings = yield* AWS.ECR.DescribeImageScanFindings(repository);

const res = yield* describeScanFindings({ imageId: { imageTag: "latest" } });
console.log(res.imageScanFindings?.findingSeverityCounts);

GetAuthorizationToken

Source: src/AWS/ECR/GetAuthorizationToken.ts

Runtime binding for ecr:GetAuthorizationToken.

Mints the temporary registry credential (AWS:<password> base64 token, valid 12 hours) a Docker client presents to the account’s private ECR registry — a registry-level operation, so the binding takes no resource and the grant is on Resource: ["*"] (the action supports no resource-level permissions). Provide the implementation with Effect.provide(AWS.ECR.GetAuthorizationTokenHttp).

The returned authorizationToken is wrapped in Redacted so it never leaks into logs — unwrap with Redacted.value(...) at the point of use.

GetAuthorizationToken: Registry Authentication

import * as Redacted from "effect/Redacted";

// init — registry-level binding takes no resource
const getAuthorizationToken = yield* AWS.ECR.GetAuthorizationToken();

// runtime
const res = yield* getAuthorizationToken();
const data = res.authorizationData?.[0];
const token = data?.authorizationToken;
const decoded = Buffer.from(
  Redacted.isRedacted(token) ? Redacted.value(token) : (token ?? ""),
  "base64",
).toString("utf8"); // "AWS:<password>" for `docker login`

GetDownloadUrlForLayer

Source: src/AWS/ECR/GetDownloadUrlForLayer.ts

Runtime binding for ecr:GetDownloadUrlForLayer.

Resolves a pre-signed S3 download URL for an image layer in the bound repository — the blob-download half of a registry pull. Provide the implementation with Effect.provide(AWS.ECR.GetDownloadUrlForLayerHttp).

GetDownloadUrlForLayer: Pulling Images

const getDownloadUrl = yield* AWS.ECR.GetDownloadUrlForLayer(repository);

const res = yield* getDownloadUrl({ layerDigest: "sha256:…" });
console.log(res.downloadUrl);

Image

Source: src/AWS/ECR/Image.ts

A Docker image built from a local context and pushed to a private Amazon ECR repository.

The image is identified by a content hash over the build context, Dockerfile, platform, and build args. An existing image with that hash is reused; a missing image is rebuilt and pushed. A content change produces a new tag on the same resource, so replacement is never needed.

Image: Building Images

Push to an ECR Repository

const repository = yield* AWS.ECR.Repository("AppRepository", {});
const image = yield* AWS.ECR.Image("AppImage", {
  repositoryUri: repository.repositoryUri,
  context: "./app",
});

Auto-created Repository

const image = yield* AWS.ECR.Image("AppImage", {
  context: "./app",
});

Image: Moving an Unchanged Build Context

const image = yield* AWS.ECR.Image("AppImage", {
  repositoryUri: repository.repositoryUri,
  context: "./app",
  context: "./relocated-app",
});

Absolute paths are not part of the image’s identity. With identical build inputs and the same repository setting, this plans a no-op. Content, Dockerfile, platform, build-argument, and repository changes still update the image. A deleted image or auto-created repository is recreated on deploy.

Image: Build Configuration

const image = yield* AWS.ECR.Image("WorkerImage", {
  repositoryUri: repository.repositoryUri,
  context: "./worker",
  dockerfile: "Dockerfile.worker",
  platform: "linux/arm64",
  buildArgs: { NODE_ENV: "production" },
});

Image: Consuming the Image

const task = yield* AWS.ECS.Task("ApiTask", {
  main: import.meta.url,
  sidecars: [{ name: "proxy", image: image.imageUri, essential: false }],
});

InitiateLayerUpload

Source: src/AWS/ECR/InitiateLayerUpload.ts

Runtime binding for ecr:InitiateLayerUpload.

Opens a layer-blob upload to the bound repository, returning the uploadId that UploadLayerPart and CompleteLayerUpload continue. Provide the implementation with Effect.provide(AWS.ECR.InitiateLayerUploadHttp).

InitiateLayerUpload: Pushing Images

const initiateUpload = yield* AWS.ECR.InitiateLayerUpload(repository);

const { uploadId } = yield* initiateUpload();

ListImages

Source: src/AWS/ECR/ListImages.ts

Runtime binding for ecr:ListImages.

Lists the image IDs (digest + tag) in the bound repository. Provide the implementation with Effect.provide(AWS.ECR.ListImagesHttp).

ListImages: Reading Images

const listImages = yield* AWS.ECR.ListImages(repository);

const res = yield* listImages({ filter: { tagStatus: "TAGGED" } });
for (const id of res.imageIds ?? []) console.log(id.imageTag);

PutImage

Source: src/AWS/ECR/PutImage.ts

Runtime binding for ecr:PutImage.

Writes an image manifest to the bound repository — the final step of a push, and the write half of re-tagging (BatchGetImage → PutImage with a new tag). Provide the implementation with Effect.provide(AWS.ECR.PutImageHttp).

PutImage: Pushing Images

const batchGetImage = yield* AWS.ECR.BatchGetImage(repository);
const putImage = yield* AWS.ECR.PutImage(repository);

const res = yield* batchGetImage({ imageIds: [{ imageTag: "latest" }] });
yield* putImage({
  imageManifest: res.images![0]!.imageManifest!,
  imageTag: "stable",
});

RegistryPolicy

Source: src/AWS/ECR/RegistryPolicy.ts

The permissions policy for a private Amazon ECR registry — an account/region singleton used to grant other AWS accounts registry-level permissions (most commonly ecr:ReplicateImage when configuring cross-account replication).

RegistryPolicy: Managing the Registry Policy

const policy = yield* RegistryPolicy("ReplicationPolicy", {
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Sid: "AllowReplication",
        Effect: "Allow",
        Principal: { AWS: `arn:aws:iam::${sourceAccountId}:root` },
        Action: ["ecr:ReplicateImage"],
        Resource: `arn:aws:ecr:us-east-1:${accountId}:repository/*`,
      },
    ],
  },
});

Repository

Source: src/AWS/ECR/Repository.ts

An Amazon ECR repository for container images.

Repository: Creating Repositories

const repo = yield* Repository("TaskRepository", {
  scanOnPush: true,
});

Repository: Repository Policies

const repo = yield* Repository("LambdaImages", {
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Sid: "LambdaECRImageRetrieval",
        Effect: "Allow",
        Principal: { Service: "lambda.amazonaws.com" },
        Action: ["ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer"],
      },
    ],
  },
});

StartImageScan

Source: src/AWS/ECR/StartImageScan.ts

Runtime binding for ecr:StartImageScan.

Starts an on-demand vulnerability scan of an image in the bound repository (basic scanning; one scan per image per day). Provide the implementation with Effect.provide(AWS.ECR.StartImageScanHttp).

StartImageScan: Image Scanning

const startImageScan = yield* AWS.ECR.StartImageScan(repository);

const res = yield* startImageScan({ imageId: { imageTag: "latest" } });
console.log(res.imageScanStatus?.status);

UploadLayerPart

Source: src/AWS/ECR/UploadLayerPart.ts

Runtime binding for ecr:UploadLayerPart.

Uploads one chunk of a layer blob to an open upload in the bound repository (non-final parts must be at least 5 MiB). Provide the implementation with Effect.provide(AWS.ECR.UploadLayerPartHttp).

UploadLayerPart: Pushing Images

const uploadPart = yield* AWS.ECR.UploadLayerPart(repository);

yield* uploadPart({
  uploadId: uploadId!,
  partFirstByte: 0,
  partLastByte: blob.length - 1,
  layerPartBlob: blob,
});