Copy Amazon ECR container images across AWS accounts and AWS Regions

Configure the source account profile:

aws configure --profile source-account
# Enter: Access Key ID, Secret Access Key, Default region, Output format (json)

Configure the destination account profile:

aws configure --profile destination-account 
# Enter: Access Key ID, Secret Access Key, Default region, Output format (json) 

Verify the configurations:

aws sts get-caller-identity --profile source-account 
aws sts get-caller-identity --profile destination-account

Get the source account ID:

export SOURCE_ACCOUNT_ID=$(aws sts get-caller-identity --profile source-account --query Account --output text)
echo "Source Account ID: $SOURCE_ACCOUNT_ID"

Get the destination account ID:

export DEST_ACCOUNT_ID=$(aws sts get-caller-identity --profile destination-account --query Account --output text)
echo "Destination Account ID: $DEST_ACCOUNT_ID"

Set the AWS Regions. Modify this command for your Region:

export SOURCE_REGION="us-east-1"
export DEST_REGION="us-east-2"

List the existing Amazon ECR repositories in the source account:

aws ecr describe-repositories --profile source-account --region $SOURCE_REGION --query 'repositories[].repositoryName' --output table

Deploy the destination account stack:

aws cloudformation deploy \
  --template-file "Destination Account cf_template.yml" \
  --stack-name ecr-copy-destination \
  --parameter-overrides \
    SourceAccountId=$SOURCE_ACCOUNT_ID \
    SourceRoleName=ECRContainerLambdaRole \
  --capabilities CAPABILITY_NAMED_IAM \
  --profile destination-account \
  --region $DEST_REGION

Wait for the stack to complete:

aws cloudformation wait stack-create-complete \
  --stack-name ecr-copy-destination \
  --profile destination-account \
  --region $DEST_REGION

Get stack outputs:

aws cloudformation describe-stacks \
  --stack-name ecr-copy-destination \
  --profile destination-account \
  --region $DEST_REGION \
  --query 'Stacks[0].Outputs' \
  --output table

Store the cross-account IAM role:

export CROSS_ACCOUNT_ROLE_ARN=$(aws cloudformation describe-stacks \
  --stack-name ecr-copy-destination \
  --profile destination-account \
  --region $DEST_REGION \
  --query 'Stacks[0].Outputs[?OutputKey==`CrossAccountRoleArn`].OutputValue' \
  --output text)

echo "Cross-Account Role ARN: $CROSS_ACCOUNT_ROLE_ARN"

Verify that Docker is running:

docker --version
docker info

Ensure that crane-app.py and Dockerfile are in the current directory:

ls -la crane-app.py Dockerfile

Build the Lambda container image:

docker build -t ecr-copy-lambda . --no-cache

Verify that the image was created:

docker images ecr-copy-lambda

(Optional) Test the container locally:

docker run --rm --entrypoint python ecr-copy-lambda -c "import boto3; print('Container working')"

Create an Amazon ECR repository in the source account:

aws ecr create-repository \
  --repository-name ecr-copy-lambda \
  --profile source-account \
  --region $SOURCE_REGION

Get an Amazon ECR login token and authenticate Docker:

aws ecr get-login-password \
  --profile source-account \
  --region $SOURCE_REGION | \
  docker login --username AWS --password-stdin \
  $SOURCE_ACCOUNT_ID.dkr.ecr.$SOURCE_REGION.amazonaws.com

Tag the image for Amazon ECR:

docker tag ecr-copy-lambda:latest \
  $SOURCE_ACCOUNT_ID.dkr.ecr.$SOURCE_REGION.amazonaws.com/ecr-copy-lambda:latest

Upload the image to Amazon ECR:

docker push $SOURCE_ACCOUNT_ID.dkr.ecr.$SOURCE_REGION.amazonaws.com/ecr-copy-lambda:latest

Store the image URI for later use:

export LAMBDA_IMAGE_URI="$SOURCE_ACCOUNT_ID.dkr.ecr.$SOURCE_REGION.amazonaws.com/ecr-copy-lambda:latest"
echo "Lambda Image URI: $LAMBDA_IMAGE_URI"

List the images in the repository:

aws ecr list-images \
  --repository-name ecr-copy-lambda \
  --profile source-account \
  --region $SOURCE_REGION

Get the image details:

aws ecr describe-images \
  --repository-name ecr-copy-lambda \
  --profile source-account \
  --region $SOURCE_REGION

Set the notification email:

export NOTIFICATION_EMAIL="your-email@company.com"

Define the repositories to copy (comma-separated):

export REPOSITORY_LIST="app-frontend,app-backend,database-migrations"

Set the environment:

export ENVIRONMENT="dev"

echo "Deployment Parameters:"
echo "Source Account: $SOURCE_ACCOUNT_ID"
echo "Destination Account: $DEST_ACCOUNT_ID"
echo "Source Region: $SOURCE_REGION"
echo "Destination Region: $DEST_REGION"
echo "Lambda Image: $LAMBDA_IMAGE_URI"
echo "Notification Email: $NOTIFICATION_EMAIL"
echo "Repositories: $REPOSITORY_LIST"

Deploy the source account stack:

aws cloudformation deploy \
  --template-file "Source Account Cf template.yml" \
  --stack-name ecr-copy-source \
  --parameter-overrides \
    SourceAccountId=$SOURCE_ACCOUNT_ID \
    DestinationAccountId=$DEST_ACCOUNT_ID \
    DestinationRegion=$DEST_REGION \
    SourceRegion=$SOURCE_REGION \
    NotificationEmail=$NOTIFICATION_EMAIL \
    RepositoryList="$REPOSITORY_LIST" \
    LambdaImageUri=$LAMBDA_IMAGE_URI \
    Environment=$ENVIRONMENT \
  --capabilities CAPABILITY_NAMED_IAM \
  --profile source-account \
  --region $SOURCE_REGION

Wait for the stack to complete (this might take up to 10 minutes):

aws cloudformation wait stack-create-complete \
  --stack-name ecr-copy-source \
  --profile source-account \
  --region $SOURCE_REGION

Get the stack outputs:

aws cloudformation describe-stacks \
  --stack-name ecr-copy-source \
  --profile source-account \
  --region $SOURCE_REGION \
  --query 'Stacks[0].Outputs' \
  --output table

Store the Amazon Resource Names (ARNs) for the state machine and SNS topic:

export STATE_MACHINE_ARN=$(aws cloudformation describe-stacks \
  --stack-name ecr-copy-source \
  --profile source-account \
  --region $SOURCE_REGION \
  --query 'Stacks[0].Outputs[?OutputKey==`StateMachineArn`].OutputValue' \
  --output text)

export SNS_TOPIC_ARN=$(aws cloudformation describe-stacks \
  --stack-name ecr-copy-source \
  --profile source-account \
  --region $SOURCE_REGION \
  --query 'Stacks[0].Outputs[?OutputKey==`SNSTopicArn`].OutputValue' \
  --output text)

echo "State Machine ARN: $STATE_MACHINE_ARN"
echo "SNS Topic ARN: $SNS_TOPIC_ARN"

Check your email for confirmation of your SNS subscription.

Choose the confirmation link in the email.

Verify the subscription status.

aws sns list-subscriptions-by-topic \
  --topic-arn $SNS_TOPIC_ARN \
  --profile source-account \
  --region $SOURCE_REGION

Sign in to the AWS Management Console, and open the Step Functions console.

Locate the state machine.

Choose Start execution.

When it finishes, results are displayed on the Execution input and output tab.

(Optional) If you want to continue running Step Functions by using the AWS CLI, follow the remaining steps in this epic.

Generate a unique name:

export EXECUTION_NAME="ecr-copy-$(date +%Y%m%d-%H%M%S)"

Run the step function.

export EXECUTION_ARN=$(aws stepfunctions start-execution \
  --state-machine-arn $STATE_MACHINE_ARN \
  --name $EXECUTION_NAME \
  --profile source-account \
  --region $SOURCE_REGION \
  --query 'executionArn' \
  --output text)

echo "Execution started: $EXECUTION_ARN"
echo "Execution Name: $EXECUTION_NAME"

Check the status:

aws stepfunctions describe-execution \
  --execution-arn $EXECUTION_ARN \
  --profile source-account \
  --region $SOURCE_REGION \
  --query '{Status:status,StartDate:startDate,StopDate:stopDate}' \
  --output table

Get the history:

aws stepfunctions get-execution-history \
  --execution-arn $EXECUTION_ARN \
  --profile source-account \
  --region $SOURCE_REGION \
  --query 'events[?type==`TaskStateEntered` || type==`TaskSucceeded` || type==`TaskFailed`].{Type:type,Timestamp:timestamp,Details:stateEnteredEventDetails.name}' \
  --output table

List the repositories in the destination account:

aws ecr describe-repositories \
  --profile destination-account \
  --region $DEST_REGION \
  --query 'repositories[].repositoryName' \
  --output table

Check the repository images:

for repo in $(echo $REPOSITORY_LIST | tr ',' ' '); do
  echo "\nImages in repository: $repo"
  aws ecr list-images \
    --repository-name $repo \
    --profile destination-account \
    --region $DEST_REGION \
    --query 'imageIds[].imageTag' \
    --output table 2>/dev/null || echo "Repository $repo not found or no images"
done