feat: Amazon Elastic Container Registry plugin

examples/entities.yaml

@@ -12,11 +12,13 @@ apiVersion: backstage.io/v1alpha1
 kind: Component
 metadata:
   name: example-website
+  namespace: default
   annotations:
     aws.amazon.com/aws-codepipeline-tags: component=example-website
     aws.amazon.com/aws-codebuild-project-tags: component=example-website
     aws.amazon.com/amazon-ecs-service-tags: component=example-website
     aws.amazon.com/cost-insights-tags: component=example-website
+    aws.amazon.com/aws-ecr-repository-arn: 1234567890.dkr.ecr.us-east-1.amazonaws.com/example-website
 spec:
   type: website
   lifecycle: experimental

packages/app/package.json

@@ -18,6 +18,7 @@
     "@aws/aws-codebuild-plugin-for-backstage": "workspace:^",
     "@aws/aws-codepipeline-plugin-for-backstage": "workspace:^",
     "@aws/cost-insights-plugin-for-backstage": "workspace:^",
+    "@aws/ecr-plugin-for-backstage": "workspace:^",
     "@backstage-community/plugin-cost-insights": "^0.12.25",
     "@backstage-community/plugin-github-actions": "^0.6.16",
     "@backstage-community/plugin-tech-radar": "^0.7.4",

packages/app/src/components/catalog/EntityPage.tsx

@@ -57,6 +57,11 @@ import {
 } from '@aws/aws-codepipeline-plugin-for-backstage';
 import { EntityAwsCodeBuildCard } from '@aws/aws-codebuild-plugin-for-backstage';
 import { EntityAmazonEcsServicesContent } from '@aws/amazon-ecs-plugin-for-backstage';
+import {
+  isAwsEcrScanResultsAvailable,
+  EntityEcrScanResultsContent,
+} from '@aws/ecr-plugin-for-backstage';
+
 
 import { TechDocsAddons } from '@backstage/plugin-techdocs-react';
 import { ReportIssue } from '@backstage/plugin-techdocs-module-addons-contrib';
@@ -216,6 +221,10 @@ const websiteEntityPage = (
       <EntityCostInsightsContent />
     </EntityLayout.Route>
 
+    <EntityLayout.Route path="/ecr-scan" title="Image Scan" if={isAwsEcrScanResultsAvailable}>
+      <EntityEcrScanResultsContent />
+    </EntityLayout.Route>
+
     <EntityLayout.Route path="/dependencies" title="Dependencies">
       <Grid container spacing={3} alignItems="stretch">
         <Grid item md={6}>

packages/backend/package.json

@@ -21,6 +21,7 @@
     "@aws/aws-codepipeline-plugin-for-backstage-backend": "workspace:^",
     "@aws/aws-core-plugin-for-backstage-scaffolder-actions": "workspace:^",
     "@aws/cost-insights-plugin-for-backstage-backend": "workspace:^",
+    "@aws/ecr-plugin-for-backstage-backend": "workspace:^",
     "@backstage/backend-defaults": "^0.5.3",
     "@backstage/backend-plugin-api": "^1.0.2",
     "@backstage/catalog-client": "^1.8.0",

packages/backend/src/index.ts

@@ -17,6 +17,7 @@ backend.add(import('@aws/amazon-ecs-plugin-for-backstage-backend'));
 backend.add(import('@aws/aws-codebuild-plugin-for-backstage-backend'));
 backend.add(import('@aws/aws-codepipeline-plugin-for-backstage-backend'));
 backend.add(import('@aws/aws-core-plugin-for-backstage-scaffolder-actions'));
+backend.add(import('@aws/ecr-plugin-for-backstage-backend'));
 
 backend.add(import('@aws/cost-insights-plugin-for-backstage-backend'));
 

plugins/ecr/README.md

@@ -0,0 +1,116 @@
+# ECR AWS plugin for Backstage
+
+This plugin is meant to allow you to view ECR Scan Results for a specific entity within your Backstage UI. 
+
+This requires that where you run Backstage has AWS Credentials that has IAM Permissions to describe images and get ECR scan findings (through enviornment variables, IRSA, etc;).
+
+The plugin consists of the following packages:
+
+- `frontend`: The frontend plugin package installed in Backstage
+- `backend`: The backend plugin package installed in Backstage
+- `common`: Types and utilities shared between the packages
+
+## Installing
+
+This guide assumes that you are familiar with the general [Getting Started](../../docs/getting-started.md) documentation and have assumes you have an existing Backstage application.
+
+### Permissions
+
+The IAM role(s) used by Backstage will require the following permissions:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ecr:DescribeImages",
+        "ecr:DescribeImageScanFindings"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+Note: This policy does not reflect least privilege and you should further limit the policy to the appropriate AWS resources.
+
+### Backend package
+
+Install the backend package in your Backstage app:
+
+```shell
+yarn workspace backend add @aws/ecr-plugin-for-backstage-backend
+```
+
+Add the plugin to the `packages/backend/src/index.ts`:
+
+```typescript
+const backend = createBackend();
+// ...
+backend.add(import('@aws/ecr-plugin-for-backstage-backend'));
+// ...
+backend.start();
+```
+
+### Frontend package
+
+Install the frontend packages in your Backstage app:
+
+```shell
+yarn workspace app add @aws/ecr-plugin-for-backstage
+```
+Edit the `packages/app/src/components/catalog/EntityPage.tsx` and add the imports
+
+```typescript jsx
+import {
+  EntityEcrScanResultsContent, 
+  isAwsEcrScanResultsAvailable 
+} from 'plugin-aws-ecr-scan';
+```
+
+Then add the following components:
+
+```typescript jsx
+  <EntityLayout.Route path="/ecr-scan" title="Image Scan" if={isAwsEcrScanResultsAvailable}>
+    <EntityEcrScanResultsContent />
+  </EntityLayout.Route>
+```
+
+## Entity annotations
+
+The plugin uses entity annotations to determine what queries to make for a given entity. The `aws.amazon.com/aws-ecr-repository-arn` annotation can be added to any catalog entity to attach an ECR Repository to the entity.
+
+```yaml
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  # ...
+  annotations:
+    aws.amazon.com/aws-ecr-repository-arn: 1234567890.dkr.ecr.us-east-1.amazonaws.com/example-website
+spec:
+  type: service
+  # ...
+```
+
+## Configuration
+
+There are configuration options available to control the behavior of the plugin.
+
+```yaml
+aws:
+  ecr:
+    accountId: '1111111111' # (Optional) Use the specified AWS account ID
+    region: 'us-west-2' # (Optional) Use the specified AWS region
+    maxImages: 1000 # (Optional) The maximum amount of images grabbed for a repository.
+    maxScanFindings: 1000 # (Optional) The maximum amount of scan findings grabbed for an individual image.
+    cache:
+      enable: true # (Optional) Control is caching is enabled, defaults to true
+      defaultTtl: 1000 # (Optional) How long responses are cached for in milliseconds, defaults to 1 day
+      readTime: 1000 # (Optional) Read timeout when operating with cache in milliseconds, defaults to 1000 ms
+```
+
+### Caching
+
+By default the responses from the backend plugin are cached for 1 day in order to improve performance to the user for querying the ECR API. The cache TTL can be configured to a different value or alternatively it can be disabled entirely if needed.

plugins/ecr/backend/.eslintrc.js

@@ -0,0 +1 @@
+module.exports = require('@backstage/cli/config/eslint-factory')(__dirname);

plugins/ecr/backend/README.md

@@ -0,0 +1,3 @@
+# ECR AWS plugin for Backstage - Backend
+
+This a backend plugin package for Backstage related to ECR for AWS. For more information see the [documentation](../README.md).

plugins/ecr/backend/dev/index.ts

@@ -0,0 +1,8 @@
+import { createBackend } from '@backstage/backend-defaults';
+
+const backend = createBackend();
+backend.add(import('@backstage/plugin-auth-backend'));
+backend.add(import('@backstage/plugin-auth-backend-module-guest-provider'));
+backend.add(import('../src'));
+
+backend.start();

plugins/ecr/backend/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@aws/ecr-plugin-for-backstage-backend",
+  "version": "0.1.0",
+  "repository": {
+    "type": "git",
+    "url": "github:awslabs/backstage-plugins-for-aws",
+    "directory": "plugins/ecs/backend"
+  },
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "types": "dist/index.d.ts"
+  },
+  "backstage": {
+    "role": "backend-plugin",
+    "pluginId": "ecr-aws",
+    "pluginPackages": [
+      "@aws/ecr-plugin-for-backstage",
+      "@aws/ecr-plugin-for-backstage-backend"
+    ]
+  },
+  "scripts": {
+    "start": "backstage-cli package start",
+    "build": "backstage-cli package build",
+    "lint": "backstage-cli package lint",
+    "test": "backstage-cli package test",
+    "clean": "backstage-cli package clean",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack"
+  },
+  "dependencies": {
+    "@aws-sdk/client-ecr": "^3.568.0",
+    "@aws-sdk/middleware-sdk-sts": "^3.523.0",
+    "@aws-sdk/types": "^3.609.0",
+    "@aws-sdk/util-arn-parser": "^3.495.0",
+    "@aws/aws-core-plugin-for-backstage-common": "workspace:^",
+    "@backstage/backend-common": "^0.25.0",
+    "@backstage/backend-plugin-api": "^1.0.2",
+    "@backstage/catalog-client": "^1.8.0",
+    "@backstage/catalog-model": "^1.7.1",
+    "@backstage/config": "^1.3.0",
+    "@backstage/errors": "^1.2.5",
+    "@backstage/integration-aws-node": "^0.1.13",
+    "@backstage/plugin-catalog-node": "^1.14.0",
+    "@types/express": "*",
+    "express": "^4.17.1",
+    "express-promise-router": "^4.1.0",
+    "luxon": "^3.4.4",
+    "node-fetch": "^2.6.7",
+    "regression": "^2.0.1",
+    "winston": "^3.2.1",
+    "yn": "^4.0.0"
+  },
+  "devDependencies": {
+    "@backstage/backend-defaults": "^0.5.3",
+    "@backstage/backend-test-utils": "^1.1.0",
+    "@backstage/cli": "^0.29.2",
+    "@backstage/plugin-auth-backend": "^0.24.0",
+    "@backstage/plugin-auth-backend-module-guest-provider": "^0.2.2",
+    "@types/luxon": "^3",
+    "@types/regression": "^2",
+    "@types/supertest": "^2.0.12",
+    "aws-sdk-client-mock": "^4.0.0",
+    "msw": "^1.0.0",
+    "supertest": "^6.2.4"
+  },
+  "files": [
+    "dist"
+  ]
+}

plugins/ecr/backend/src/cache/ECRCache.ts

@@ -0,0 +1,78 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { assertError } from '@backstage/errors';
+import { CacheService, LoggerService } from '@backstage/backend-plugin-api';
+import { EcrConfig } from '../config';
+
+const KEY_PREFIX = 'aws-ecr-provider:';
+
+export class EcrCache {
+  protected readonly cache: CacheService;
+  protected readonly logger: LoggerService;
+  protected readonly readTimeout: number;
+
+  private constructor({
+    cache,
+    logger,
+    readTimeout,
+  }: {
+    cache: CacheService;
+    logger: LoggerService;
+    readTimeout: number;
+  }) {
+    this.cache = cache;
+    this.logger = logger;
+    this.readTimeout = readTimeout;
+  }
+
+  static fromConfig(
+    config: EcrConfig,
+    { cache, logger }: { cache: CacheService; logger: LoggerService },
+  ) {
+    return new EcrCache({
+      cache: cache.withOptions({ defaultTtl: config.cache.defaultTtl }),
+      logger,
+      readTimeout: config.cache.readTimeout,
+    });
+  }
+
+  async get(path: string): Promise<string | undefined> {
+    try {
+      const response = (await Promise.race([
+        this.cache.get(`${KEY_PREFIX}${path}`),
+        new Promise(cancelAfter => setTimeout(cancelAfter, this.readTimeout)),
+      ])) as string | undefined;
+
+      if (response !== undefined) {
+        this.logger.debug(`Cache hit: ${path}`);
+        return response;
+      }
+
+      this.logger.debug(`Cache miss: ${path}`);
+      return response;
+    } catch (e) {
+      assertError(e);
+      this.logger.warn(`Error getting cache entry ${path}: ${e.message}`);
+      this.logger.debug(e.stack || '-');
+      return undefined;
+    }
+  }
+
+  async set(path: string, data: string): Promise<void> {
+    this.logger.debug(`Writing cache entry for ${path}`);
+    this.cache
+      .set(`${KEY_PREFIX}${path}`, data)
+      .catch(e => this.logger.error('write error', e));
+  }
+}

plugins/ecr/backend/src/cache/index.ts

@@ -0,0 +1,14 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export * from './ECRCache';