feat: add organizations as readonly access

[dragosmc]

what

• Add the ability to have organizations as trustees (read-only) for the ECR repository

why

• As described in Allow the whole AWS Org for readonly #82 , it's sometimes useful to allow an entire organization to consume images from a centralized repository

references

• closes Allow the whole AWS Org for readonly #82

[Gowiem]

@dragosmc we're reworking these policies in #105 -- Let's hold off on this type of work until that is merged and then you can take another crack at this PR. The way policies were originally (or additionally) implemented is leading to some funky code that I want to put a stop to.

[Gowiem]

@dragosmc the rework of the funky way we were handling policies has merged (#105). Mind updating this to reflect the new pattern that we create a policy document for each type of policy?

[adamantike]

It would be great to see this merged!
As a follow up after this one, we can add support for access to specific Organizational Units.

[Gowiem]

@dragosmc friendly ping here. Mind fixing conflicts + reworking after #105?

[dragosmc]

Ready for a review 👍

[dragosmc]

Thanks for the review @adamantike - everythng should be fixed now.

LE: about the docs, is that an automated job that runs in CI to update them? I couldn't find a target in makefile for that

[dragosmc]

Hi team, this is ready for another round of review. 🎉

[adamantike]

@joe-niland, gentle ping. Can this be reviewed?

[Gowiem]

@dragosmc generally, this looks good and seems to follow the pattern we've set out. Thanks for the updates. To move this forward, please run the following commands, commit, and push the changes:

make init
make github/init
make readme

I'll give it another review once that is done -- Thanks!

[dragosmc]

@dragosmc generally, this looks good and seems to follow the pattern we've set out. Thanks for the updates. To move this forward, please run the following commands, commit, and push the changes:

make init
make github/init
make readme

I'll give it another review once that is done -- Thanks!

Trying to run the above I get the following error:

* Installing terraform-docs to /Users/dragos/opensource/terraform-aws-ecr/build-harness/vendor
mkdir -p -m a+rX /Users/dragos/opensource/terraform-aws-ecr/build-harness/vendor
[ -n "/tmp" ] && [ -n "terraform-docs" ] && rm -rf "/tmp/terraform-docs"
mkdir -p /tmp/terraform-docs
curl --retry 3 --retry-delay 5 --fail -sSL -o - https://github.com/segmentio/terraform-docs/releases/download/v0.16.0/terraform-docs-v0.16.0-darwin-arm64.tar.gz | tar -zx -C /tmp/terraform-docs
find /tmp/terraform-docs -type f -name terraform-docs | xargs -I {} cp -f {} /Users/dragos/opensource/terraform-aws-ecr/build-harness/vendor/terraform-docs
chmod +x /Users/dragos/opensource/terraform-aws-ecr/build-harness/vendor/terraform-docs
[ -n "/tmp" ] && [ -n "terraform-docs" ] && rm -rf "/tmp/terraform-docs"
make: gomplate: No such file or directory
make: *** [readme/build] Error 1

[Gowiem]

@dragosmc I believe the gomplate installation is broken via make. Can you please install that tool via whatever platform you're on and try again. If you're on Mac, then brew install gomplate will do.

[max-lobur]

brew install make
make --version
GNU Make 4.4.1

make precommit/terraform # Run dockerized version of precommit hook that we use in CI.

[max-lobur]

Ensuring make version alone might fix the issue too.

[dragosmc]

Thanks @max-lobur @Gowiem . Ensure the correct make version works fine. I see the tests for the readme still fail so not sure what the problem is. Could you have a look please and let me know if there's anything else I need to run?

[Gowiem]

@dragosmc this change here is what is causing your README failures. I think this may be an issue with an older version of terraform-docs. Maybe try upgrading that and then seeing if this gets the changes when you run make readme again?

[adamantike]

I have experienced this issue in the past, where terraform-docs resolves the current provider version instead of maintaining the version constraint. I have always just reverted those changed lines back, if I'm not touching anything related to providers or dependencies.

[Gowiem]

/terratest