AWS trigger a Pipeline on ECR push action?

Question

An AWS CodePipeline can be triggered on a commit action to AWS CodeCommit.

---

I do not see an option/way to trigger an AWS CodePipeline on a push action to AWS ECR. Is there a such option?

Answer 1

So, Cloudwatch Events is the way to do it per here. For those who wants to do it via CFN approach - The below CFN template would help.

{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
    "CodePipelineName": {
        "Type": "String",
        "Description": "Name of the CodePipeline Project that needs to be triggered. NOTE: CodePipeline does not support ARN output but AWS::Events::Rule target expects an ARN"
    },
    "ECRRepoName": {
        "Type": "String",
        "Description": "Name of the ECR Repo on which the Trigger needs to be set-up"
    },
    "ECRImageTagName": {
        "Type": "String",
        "Description": "Name of the ECR Image tag on which the Trigger needs to be set-up",
        "Default": "latest"
    }
},
"Resources": {
    "AmazonCloudWatchEventRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": [
                                "events.amazonaws.com"
                            ]
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Path": "/",
            "Policies": [
                {
                    "PolicyName": "cwe-pipeline-execution",
                    "PolicyDocument": {
                        "Version": "2012-10-17",
                        "Statement": [
                            {
                                "Effect": "Allow",
                                "Action": "codepipeline:StartPipelineExecution",
                                "Resource": {
                                    "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${CodePipelineName}"
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "AmazonCloudWatchEventRule": {
        "Type": "AWS::Events::Rule",
        "Properties": {
            "EventPattern": {
                "detail": {
                    "action-type": [
                        "PUSH"
                    ],
                    "image-tag": [
                        {
                            "Ref": "ECRImageTagName"
                        }
                    ],
                    "repository-name": [
                        {
                            "Ref": "ECRRepoName"
                        }
                    ],
                    "result": [
                        "SUCCESS"
                    ]
                },
                "detail-type": [
                    "ECR Image Action"
                ],
                "source": [
                    "aws.ecr"
                ]
            },
            "Targets": [
                {
                    "Arn": {
                        "Fn::Sub": "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${CodePipelineName}"
                    },
                    "RoleArn": {
                        "Fn::GetAtt": [
                            "AmazonCloudWatchEventRole",
                            "Arn"
                        ]
                    },
                    "Id": {
                        "Ref": "CodePipelineName"
                    }
                }
            ]
        }
    }
}

}enter code here

Answer 2

If you create a Pipeline from AWS CodePipeline Console and choose Amazon ECR as source provider, it will create a CloudWatch event

{
  "source": [
    "aws.ecr"
  ],
  "detail": {
    "eventName": [
      "PutImage"
    ],
    "requestParameters": {
      "repositoryName": [
        "my-repo/nginx"
      ],
      "imageTag": [
        "0.1"
      ]
    }
  }

Target of this event will be the CodePipeline. You can inspect the Event details in AWS CloudWatch console. Whenever a Push (PutImage) occurs on the ECR repo, Pipeline will be excecuted.