Terraform:Create image repositories and grant permissions by using Terraform modules

Prerequisites

• Container Registry is activated. For more information, see Billing rules.

• We recommend that you use a RAM user to perform the operations described in this tutorial and grant the AliyunRAMFullAccess and AliyunContainerRegistryFullAccess permissions to the RAM user. For more information, see Create a RAM user and Grant permissions to a RAM user.

• The runtime environment for Terraform is prepared by using one of the following methods:

  • Explorer: Alibaba Cloud provides an online runtime environment for Terraform. You can log on to the environment and use Terraform without needing to install it. Suitable for scenarios where you need to use and debug Terraform in a low-cost, efficient, and convenient manner.

  • Cloud Shell: Cloud Shell is preinstalled with Terraform and configured with your identity credentials. You can run Terraform commands in Cloud Shell. Suitable for scenarios where you need to use and access Terraform in a low-cost, efficient, and convenient manner.

  • Install and configure Terraform on your on-premises machine: Suitable for scenarios where network connections are unstable or a custom development environment is needed.

Resources used

• alicloud_cr_namespace: a Container Registry namespace.

• alicloud_cr_repo: an image repository.

• alicloud_ram_access_key: an AccessKey pair of the RAM user.

• alicloud_ram_login_profile: the console logon settings for the RAM user.

• alicloud_ram_policy: a policy.

• alicloud_ram_user: a RAM user.

• alicloud_ram_user_policy_attachment: grants permissions to the RAM user.

Procedure

1. Create a working directory. Then, create a configuration file named main.tf in the directory. Copy the following code to the main.tf configuration file.

   provider "alicloud" {}
   
   resource "random_integer" "default" {
     min = 10000
     max = 99999
   }
   
   module "cr" {
     source       = "roura356a/cr/alicloud"
     version      = "1.3.1"
     # The name of the namespace. 
     namespace    = "cr_repo_namespace_auto-${random_integer.default.result}"
     # The repositories that are created and authorized.
     repositories = ["one", "two", "three"]
     # The logon password of the RAM user. When you use this template, use a strong password.
     password     = "YourPassword@123"
   }

2. Run the following command to initialize the Terraform runtime environment:

   terraform init

   If the following information is returned, Terraform is initialized.

   Terraform has been successfully initialized!
   
   You may now begin working with Terraform. Try running "terraform plan" to see
   any changes that are required for your infrastructure. All Terraform commands
   should now work.
   
   If you ever set or change modules or backend configuration for Terraform,
   rerun this command to reinitialize your working directory. If you forget, other
   commands will detect it and remind you to do so if necessary.

3. Run the following command to execute the code.

   terraform apply

   During the code execution, enter yes as prompted and press the Enter key. Wait until the command is run. If the following information is returned, the code is executed.

   Important

   After the code is executed, a file that stores the AccessKey pair is generated in the current directory. Keep the AccessKey pair confidential.

   module.cr.data.alicloud_account.current: Reading...
   module.cr.data.alicloud_regions.current: Reading...
   module.cr.data.alicloud_account.current: Read complete after 0s [id=*******]
   module.cr.data.alicloud_regions.current: Read complete after 0s [id=******]
   
   Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
     + create
   ...
   
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: yes
   
   
   Apply complete!  Resources: 4 added, 0 changed, 0 destroyed.

4. Verify the result.

   Run the terraform show command

   Run the following command in the working directory to query the details of the resources that are created by using Terraform:

   terraform show

   

   Log on to the console

   1. Log on to the Container Registry console, go to the Instances page, click Instance of Personal Edition, and choose Repository > Repositories to view the created repository.

      

   2. Log on to the RAM console, choose Identities > Users, and then click User Logon Name/Display Name of the created RAM user.

      

   3. On the Permissions tab, view the permissions of the RAM user.

      

Release resources

If you no longer require the preceding resources that are created or managed by using Terraform, run the following command to release the resources. For more information about the terraform destroy command, see Common commands.

terraform destroy

References

• For more information about Terraform, see What is Terraform?

• Timeouts of the terraform init command due to network latency and other reasons can lead to issues such as the inability to download the provider. For more information about how to resolve this issue, see the Terraform Init acceleration configuration topic.