# プライベートリポジトリの作成
aws ecr create-repository \
  --repository-name my-app \
  --image-scanning-configuration scanOnPush=true \
  --encryption-configuration encryptionType=AES256 \
  --image-tag-mutability IMMUTABLE
 
# 出力例:
# {
#   "repository": {
#     "repositoryArn": "arn:aws:ecr:ap-northeast-1:123456789012:repository/my-app",
#     "repositoryUri": "123456789012.dkr.ecr.ap-northeast-1.amazonaws.com/my-app",
#     "repositoryName": "my-app"
#   }
# }
 
# KMS 暗号化を使用するリポジトリの作成
aws ecr create-repository \
  --repository-name my-secure-app \
  --image-scanning-configuration scanOnPush=true \
  --encryption-configuration '{
    "encryptionType": "KMS",
    "kmsKey": "arn:aws:kms:ap-northeast-1:123456789012:key/12345678-1234-1234-1234-123456789012"
  }' \
  --image-tag-mutability IMMUTABLE
 
# 名前空間付きリポジトリの作成 (組織構造を反映)
aws ecr create-repository --repository-name team-a/frontend
aws ecr create-repository --repository-name team-a/backend
aws ecr create-repository --repository-name team-b/data-pipeline
aws ecr create-repository --repository-name shared/base-images
 
# リポジトリの一覧表示
aws ecr describe-repositories \
  --query 'repositories[*].{Name: repositoryName, URI: repositoryUri, Scanning: imageScanningConfiguration.scanOnPush, TagMutability: imageTagMutability}'
 
# リポジトリの削除 (イメージが含まれている場合は --force が必要)
aws ecr delete-repository \
  --repository-name my-old-app \
  --force

# タグの不変性設定の変更
aws ecr put-image-tag-mutability \
  --repository-name my-app \
  --image-tag-mutability IMMUTABLE

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPullFromProdAccount",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::987654321098:root"
      },
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability"
      ]
    },
    {
      "Sid": "AllowPullFromSpecificRole",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::987654321098:role/ECSTaskExecutionRole"
      },
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability"
      ]
    },
    {
      "Sid": "AllowPushFromCICD",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111222333444:role/CICDPipelineRole"
      },
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ]
    }
  ]
}

# リポジトリポリシーの適用
aws ecr set-repository-policy \
  --repository-name my-app \
  --policy-text file://ecr-policy.json
 
# リポジトリポリシーの確認
aws ecr get-repository-policy \
  --repository-name my-app
 
# リポジトリポリシーの削除
aws ecr delete-repository-policy \
  --repository-name my-app

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPullFromOrganization",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-1234567890"
        }
      }
    }
  ]
}

# レジストリポリシーの設定
aws ecr put-registry-policy \
  --policy-text file://registry-policy.json
 
# レジストリポリシーの確認
aws ecr get-registry-policy

# 変数定義
AWS_ACCOUNT_ID=123456789012
REGION=ap-northeast-1
REPO_NAME=my-app
IMAGE_TAG=v1.0.0
ECR_URI="${AWS_ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com"
 
# 1. ECR にログイン
aws ecr get-login-password --region ${REGION} | \
  docker login --username AWS --password-stdin ${ECR_URI}
 
# 2. イメージのビルド
docker build -t ${REPO_NAME}:${IMAGE_TAG} .
 
# 3. ECR 用にタグ付け
docker tag ${REPO_NAME}:${IMAGE_TAG} ${ECR_URI}/${REPO_NAME}:${IMAGE_TAG}
 
# 4. プッシュ
docker push ${ECR_URI}/${REPO_NAME}:${IMAGE_TAG}
 
# 5. イメージ一覧の確認
aws ecr list-images --repository-name ${REPO_NAME}
 
# 6. イメージの詳細確認
aws ecr describe-images \
  --repository-name ${REPO_NAME} \
  --image-ids imageTag=${IMAGE_TAG} \
  --query 'imageDetails[0].{
    Digest: imageDigest,
    Tags: imageTags,
    Size: imageSizeInBytes,
    PushedAt: imagePushedAt,
    ScanStatus: imageScanStatus.status,
    ScanFindings: imageScanFindingsSummary
  }'
 
# 7. イメージの削除
aws ecr batch-delete-image \
  --repository-name ${REPO_NAME} \
  --image-ids imageTag=v0.9.0
 
# 8. マルチアーキテクチャビルド (amd64 + arm64)
docker buildx create --use
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t ${ECR_URI}/${REPO_NAME}:${IMAGE_TAG} \
  --push .

# ---- ビルドステージ ----
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build
 
# ---- 本番ステージ ----
FROM node:20-alpine AS production
WORKDIR /app
 
# セキュリティ: 非rootユーザーで実行
RUN addgroup -g 1001 -S appgroup && \
    adduser -S appuser -u 1001 -G appgroup
USER appuser
 
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:appgroup /app/package.json ./
 
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD wget -qO- http://localhost:8080/health || exit 1
 
CMD ["node", "dist/server.js"]

# Go アプリケーション用の超軽量イメージ
FROM golang:1.22-alpine AS builder
 
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
 
COPY . .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -ldflags="-w -s" -o /app/server ./cmd/server
 
# distroless イメージで実行 (シェルすらない超軽量イメージ)
FROM gcr.io/distroless/static-debian12:nonroot
 
COPY --from=builder /app/server /server
 
USER nonroot:nonroot
EXPOSE 8080
 
ENTRYPOINT ["/server"]

# Python アプリケーション用の最適化 Dockerfile
FROM python:3.12-slim AS builder
 
WORKDIR /app
 
# 仮想環境を使って依存関係を分離
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
 
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
 
# 本番ステージ
FROM python:3.12-slim
 
# セキュリティパッチの適用
RUN apt-get update && apt-get upgrade -y && \
    apt-get install -y --no-install-recommends curl && \
    rm -rf /var/lib/apt/lists/*
 
# 非rootユーザーの作成
RUN useradd --create-home --shell /bin/bash appuser
USER appuser
 
WORKDIR /app
 
# ビルドステージから仮想環境をコピー
COPY --from=builder --chown=appuser:appuser /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
 
COPY --chown=appuser:appuser . .
 
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD curl -f http://localhost:8080/health || exit 1
 
CMD ["gunicorn", "--bind", "0.0.0.0:8080", "--workers", "4", "app:app"]

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "untagged イメージを7日後に削除",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 7
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "dev タグは最新5個を保持",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["dev-"],
        "countType": "imageCountMoreThan",
        "countNumber": 5
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 3,
      "description": "stg タグは最新10個を保持",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["stg-"],
        "countType": "imageCountMoreThan",
        "countNumber": 10
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 4,
      "description": "release タグは最新100個を保持",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["v", "release-"],
        "countType": "imageCountMoreThan",
        "countNumber": 100
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 5,
      "description": "その他のタグ付きイメージは90日で削除",
      "selection": {
        "tagStatus": "any",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 90
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}

# ライフサイクルポリシーの適用
aws ecr put-lifecycle-policy \
  --repository-name my-app \
  --lifecycle-policy-text file://lifecycle-policy.json
 
# ポリシーの確認
aws ecr get-lifecycle-policy \
  --repository-name my-app
 
# ポリシーのプレビュー (ドライラン)
aws ecr start-lifecycle-policy-preview \
  --repository-name my-app \
  --lifecycle-policy-text file://lifecycle-policy.json
 
# プレビュー結果の確認
aws ecr get-lifecycle-policy-preview \
  --repository-name my-app
 
# ポリシーの削除
aws ecr delete-lifecycle-policy \
  --repository-name my-app
 
# 全リポジトリに一括適用するスクリプト
REPOS=$(aws ecr describe-repositories --query 'repositories[*].repositoryName' --output text)
for REPO in $REPOS; do
  echo "Applying lifecycle policy to ${REPO}..."
  aws ecr put-lifecycle-policy \
    --repository-name "${REPO}" \
    --lifecycle-policy-text file://lifecycle-policy.json
done

# ベーシックスキャンの有効化 (リポジトリ単位)
aws ecr put-image-scanning-configuration \
  --repository-name my-app \
  --image-scanning-configuration scanOnPush=true
 
# 拡張スキャンの有効化 (レジストリ単位)
aws ecr put-registry-scanning-configuration \
  --scan-type ENHANCED \
  --rules '[
    {
      "repositoryFilters": [
        {
          "filter": "*",
          "filterType": "WILDCARD"
        }
      ],
      "scanFrequency": "CONTINUOUS_SCAN"
    }
  ]'
 
# 手動スキャンの開始
aws ecr start-image-scan \
  --repository-name my-app \
  --image-id imageTag=v1.0.0
 
# スキャン結果の確認
aws ecr describe-image-scan-findings \
  --repository-name my-app \
  --image-id imageTag=v1.0.0
 
# 重要度別のフィルタリング
aws ecr describe-image-scan-findings \
  --repository-name my-app \
  --image-id imageTag=v1.0.0 \
  --query 'imageScanFindings.findingsSeverityCounts'
 
# CRITICAL と HIGH の脆弱性のみ表示
aws ecr describe-image-scan-findings \
  --repository-name my-app \
  --image-id imageTag=v1.0.0 \
  --query 'imageScanFindings.findings[?severity==`CRITICAL` || severity==`HIGH`].{
    Name: name,
    Severity: severity,
    Description: description,
    URI: uri
  }'

# EventBridge ルールで ECR スキャン完了イベントを検知し、
# CRITICAL/HIGH 脆弱性があれば Slack に通知する Lambda
import json
import os
import urllib3
 
SLACK_WEBHOOK_URL = os.environ["SLACK_WEBHOOK_URL"]
 
def lambda_handler(event, context):
    detail = event["detail"]
    repo = detail["repository-name"]
    tag = detail["image-tags"][0] if detail.get("image-tags") else "untagged"
    severity_counts = detail["finding-severity-counts"]
 
    critical = severity_counts.get("CRITICAL", 0)
    high = severity_counts.get("HIGH", 0)
    medium = severity_counts.get("MEDIUM", 0)
 
    if critical > 0 or high > 0:
        color = "#ff0000" if critical > 0 else "#ff9900"
        message = {
            "attachments": [
                {
                    "color": color,
                    "title": f"ECR Image Scan Alert: {repo}:{tag}",
                    "fields": [
                        {"title": "CRITICAL", "value": str(critical), "short": True},
                        {"title": "HIGH", "value": str(high), "short": True},
                        {"title": "MEDIUM", "value": str(medium), "short": True},
                        {"title": "Repository", "value": repo, "short": True}
                    ],
                    "text": "脆弱性が検出されました。確認してください。",
                    "footer": "Amazon ECR Image Scan"
                }
            ]
        }
        http = urllib3.PoolManager()
        http.request("POST", SLACK_WEBHOOK_URL,
                     body=json.dumps(message),
                     headers={"Content-Type": "application/json"})
 
    return {"statusCode": 200, "body": "Processed"}

# EventBridge ルール (CloudFormation)
ECRScanEventRule:
  Type: AWS::Events::Rule
  Properties:
    Name: ecr-scan-findings
    Description: ECR スキャン完了イベントを検知
    EventPattern:
      source:
        - "aws.ecr"
      detail-type:
        - "ECR Image Scan"
      detail:
        scan-status:
          - "COMPLETE"
        finding-severity-counts:
          CRITICAL:
            - numeric: [">", 0]
    Targets:
      - Arn: !GetAtt ScanNotificationFunction.Arn
        Id: ScanNotification

#!/bin/bash
# CI/CD パイプラインでのイメージスキャンゲート
# CRITICAL/HIGH 脆弱性がある場合はデプロイをブロック
 
REPO_NAME=$1
IMAGE_TAG=$2
MAX_CRITICAL=0
MAX_HIGH=0
 
echo "Waiting for scan to complete..."
aws ecr wait image-scan-complete \
  --repository-name ${REPO_NAME} \
  --image-id imageTag=${IMAGE_TAG}
 
# スキャン結果の取得
FINDINGS=$(aws ecr describe-image-scan-findings \
  --repository-name ${REPO_NAME} \
  --image-id imageTag=${IMAGE_TAG} \
  --query 'imageScanFindings.findingsSeverityCounts')
 
CRITICAL=$(echo ${FINDINGS} | jq -r '.CRITICAL // 0')
HIGH=$(echo ${FINDINGS} | jq -r '.HIGH // 0')
 
echo "Scan Results: CRITICAL=${CRITICAL}, HIGH=${HIGH}"
 
if [ "${CRITICAL}" -gt "${MAX_CRITICAL}" ]; then
  echo "ERROR: ${CRITICAL} CRITICAL vulnerabilities found. Maximum allowed: ${MAX_CRITICAL}"
  exit 1
fi
 
if [ "${HIGH}" -gt "${MAX_HIGH}" ]; then
  echo "ERROR: ${HIGH} HIGH vulnerabilities found. Maximum allowed: ${MAX_HIGH}"
  exit 1
fi
 
echo "Scan passed. Proceeding with deployment."
exit 0

# クロスリージョンレプリケーション設定
aws ecr put-replication-configuration \
  --replication-configuration '{
    "rules": [
      {
        "destinations": [
          {
            "region": "us-east-1",
            "registryId": "123456789012"
          },
          {
            "region": "eu-west-1",
            "registryId": "123456789012"
          }
        ],
        "repositoryFilters": [
          {
            "filter": "prod-",
            "filterType": "PREFIX_MATCH"
          }
        ]
      }
    ]
  }'
 
# クロスアカウントレプリケーション設定
aws ecr put-replication-configuration \
  --replication-configuration '{
    "rules": [
      {
        "destinations": [
          {
            "region": "ap-northeast-1",
            "registryId": "987654321098"
          }
        ],
        "repositoryFilters": [
          {
            "filter": "shared/",
            "filterType": "PREFIX_MATCH"
          }
        ]
      }
    ]
  }'
 
# レプリケーション設定の確認
aws ecr describe-registry \
  --query 'replicationConfiguration'
 
# 宛先アカウント側でのレジストリポリシー設定
# (レプリケーションを受け入れるために必要)
aws ecr put-registry-policy \
  --policy-text '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "AllowReplication",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::123456789012:root"
        },
        "Action": [
          "ecr:CreateRepository",
          "ecr:ReplicateImage"
        ],
        "Resource": "arn:aws:ecr:ap-northeast-1:987654321098:repository/*"
      }
    ]
  }'

# プルスルーキャッシュルールの作成
aws ecr create-pull-through-cache-rule \
  --ecr-repository-prefix docker-hub \
  --upstream-registry-url registry-1.docker.io
 
# GitHub Container Registry のキャッシュ
aws ecr create-pull-through-cache-rule \
  --ecr-repository-prefix ghcr \
  --upstream-registry-url ghcr.io
 
# Quay.io のキャッシュ
aws ecr create-pull-through-cache-rule \
  --ecr-repository-prefix quay \
  --upstream-registry-url quay.io
 
# プルスルーキャッシュの利用
# docker pull 123456789012.dkr.ecr.ap-northeast-1.amazonaws.com/docker-hub/library/nginx:latest
# → 初回は Docker Hub からプル、以降は ECR キャッシュからプル
 
# キャッシュルールの一覧
aws ecr describe-pull-through-cache-rules
 
# キャッシュルールの削除
aws ecr delete-pull-through-cache-rule \
  --ecr-repository-prefix docker-hub

# .github/workflows/build-and-push.yml
name: Build and Push to ECR
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
env:
  AWS_REGION: ap-northeast-1
  ECR_REPOSITORY: my-app
 
jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
 
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
          aws-region: ${{ env.AWS_REGION }}
 
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
 
      - name: Build, tag, and push image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:latest .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
 
      - name: Wait for scan and check results
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          aws ecr wait image-scan-complete \
            --repository-name $ECR_REPOSITORY \
            --image-id imageTag=$IMAGE_TAG
          CRITICAL=$(aws ecr describe-image-scan-findings \
            --repository-name $ECR_REPOSITORY \
            --image-id imageTag=$IMAGE_TAG \
            --query 'imageScanFindings.findingsSeverityCounts.CRITICAL' \
            --output text)
          if [ "$CRITICAL" != "None" ] && [ "$CRITICAL" -gt 0 ]; then
            echo "CRITICAL vulnerabilities found: $CRITICAL"
            exit 1
          fi

# buildspec.yml
version: 0.2
 
env:
  variables:
    AWS_DEFAULT_REGION: ap-northeast-1
    ECR_REPO_NAME: my-app
 
phases:
  pre_build:
    commands:
      - echo Logging in to Amazon ECR...
      - ECR_URI="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com"
      - aws ecr get-login-password | docker login --username AWS --password-stdin ${ECR_URI}
      - IMAGE_TAG=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)
      - IMAGE_URI="${ECR_URI}/${ECR_REPO_NAME}"
 
  build:
    commands:
      - echo Build started on `date`
      - docker build -t ${IMAGE_URI}:${IMAGE_TAG} .
      - docker tag ${IMAGE_URI}:${IMAGE_TAG} ${IMAGE_URI}:latest
 
  post_build:
    commands:
      - echo Pushing the Docker image...
      - docker push ${IMAGE_URI}:${IMAGE_TAG}
      - docker push ${IMAGE_URI}:latest
      - echo Writing image definitions file...
      - printf '[{"name":"web","imageUri":"%s"}]' ${IMAGE_URI}:${IMAGE_TAG} > imagedefinitions.json
 
artifacts:
  files:
    - imagedefinitions.json

# Cosign によるイメージ署名
# 1. キーペアの生成
cosign generate-key-pair
 
# 2. イメージへの署名
cosign sign --key cosign.key \
  ${ECR_URI}/${REPO_NAME}:${IMAGE_TAG}
 
# 3. 署名の検証
cosign verify --key cosign.pub \
  ${ECR_URI}/${REPO_NAME}:${IMAGE_TAG}
 
# 4. キーレス署名 (OIDC プロバイダ利用)
cosign sign --identity-token=$(gcloud auth print-identity-token) \
  ${ECR_URI}/${REPO_NAME}:${IMAGE_TAG}

# Syft による SBOM 生成
syft ${ECR_URI}/${REPO_NAME}:${IMAGE_TAG} \
  -o spdx-json > sbom.spdx.json
 
# SBOM を ECR に OCI アーティファクトとしてアタッチ
cosign attach sbom \
  --sbom sbom.spdx.json \
  ${ECR_URI}/${REPO_NAME}:${IMAGE_TAG}
 
# Grype による SBOM ベースの脆弱性スキャン
grype sbom:sbom.spdx.json

AWSTemplateFormatVersion: '2010-09-09'
Description: 'ECR リポジトリ構成テンプレート'
 
Parameters:
  EnvironmentName:
    Type: String
    Default: prod
    AllowedValues: [dev, stg, prod]
 
  ProjectName:
    Type: String
    Default: my-app
 
Resources:
  # ECR リポジトリ
  ECRRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: !Sub '${ProjectName}'
      ImageScanningConfiguration:
        ScanOnPush: true
      ImageTagMutability: IMMUTABLE
      EncryptionConfiguration:
        EncryptionType: AES256
      LifecyclePolicy:
        LifecyclePolicyText: |
          {
            "rules": [
              {
                "rulePriority": 1,
                "description": "untagged images expire after 7 days",
                "selection": {
                  "tagStatus": "untagged",
                  "countType": "sinceImagePushed",
                  "countUnit": "days",
                  "countNumber": 7
                },
                "action": {"type": "expire"}
              },
              {
                "rulePriority": 2,
                "description": "Keep last 50 tagged images",
                "selection": {
                  "tagStatus": "tagged",
                  "tagPrefixList": ["v"],
                  "countType": "imageCountMoreThan",
                  "countNumber": 50
                },
                "action": {"type": "expire"}
              }
            ]
          }
      RepositoryPolicyText:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowPullFromProdAccount
            Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action:
              - ecr:GetDownloadUrlForLayer
              - ecr:BatchGetImage
              - ecr:BatchCheckLayerAvailability
      Tags:
        - Key: Environment
          Value: !Ref EnvironmentName
        - Key: Project
          Value: !Ref ProjectName
 
  # スキャン通知用 EventBridge ルール
  ECRScanRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub '${ProjectName}-ecr-scan-alert'
      EventPattern:
        source:
          - aws.ecr
        detail-type:
          - ECR Image Scan
        detail:
          repository-name:
            - !Ref ECRRepository
          scan-status:
            - COMPLETE
      Targets:
        - Arn: !Ref AlertTopic
          Id: ECRScanAlert
          InputTransformer:
            InputPathsMap:
              repo: $.detail.repository-name
              tag: $.detail.image-tags[0]
              critical: $.detail.finding-severity-counts.CRITICAL
              high: $.detail.finding-severity-counts.HIGH
            InputTemplate: |
              "ECR Scan Alert: <repo>:<tag> - CRITICAL: <critical>, HIGH: <high>"
 
  # SNS トピック
  AlertTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${ProjectName}-ecr-alerts'
 
Outputs:
  RepositoryUri:
    Description: ECR リポジトリ URI
    Value: !GetAtt ECRRepository.RepositoryUri
    Export:
      Name: !Sub '${ProjectName}-ECRRepositoryUri'
 
  RepositoryArn:
    Description: ECR リポジトリ ARN
    Value: !GetAtt ECRRepository.Arn

# 演習1: 基本実装のテンプレート
class Exercise1:
    """基本的な実装パターンの演習"""
 
    def __init__(self):
        self.data = []
 
    def validate_input(self, value):
        """入力値の検証"""
        if value is None:
            raise ValueError("入力値がNoneです")
        return True
 
    def process(self, value):
        """データ処理のメインロジック"""
        self.validate_input(value)
        self.data.append(value)
        return self.data
 
    def get_results(self):
        """処理結果の取得"""
        return {
            'count': len(self.data),
            'data': self.data
        }
 
# テスト
def test_exercise1():
    ex = Exercise1()
    assert ex.process(1) == [1]
    assert ex.process(2) == [1, 2]
    assert ex.get_results()['count'] == 2
 
    try:
        ex.process(None)
        assert False, "例外が発生するべき"
    except ValueError:
        pass
 
    print("全テスト合格!")
 
test_exercise1()

# 演習2: 応用パターン
from typing import List, Dict, Optional
from datetime import datetime
 
class AdvancedExercise:
    """応用パターンの演習"""
 
    def __init__(self, max_size: int = 100):
        self._items: List[Dict] = []
        self._max_size = max_size
        self._created_at = datetime.now()
 
    def add(self, key: str, value: any) -> bool:
        """アイテムの追加（サイズ制限付き）"""
        if len(self._items) >= self._max_size:
            return False
        self._items.append({
            'key': key,
            'value': value,
            'timestamp': datetime.now().isoformat()
        })
        return True
 
    def find(self, key: str) -> Optional[Dict]:
        """キーによる検索"""
        for item in reversed(self._items):
            if item['key'] == key:
                return item
        return None
 
    def remove(self, key: str) -> bool:
        """キーによる削除"""
        for i, item in enumerate(self._items):
            if item['key'] == key:
                self._items.pop(i)
                return True
        return False
 
    def stats(self) -> Dict:
        """統計情報"""
        return {
            'total_items': len(self._items),
            'max_size': self._max_size,
            'usage_percent': len(self._items) / self._max_size * 100,
            'uptime': str(datetime.now() - self._created_at)
        }
 
# テスト
def test_advanced():
    ex = AdvancedExercise(max_size=3)
    assert ex.add("a", 1) == True
    assert ex.add("b", 2) == True
    assert ex.add("c", 3) == True
    assert ex.add("d", 4) == False  # サイズ制限
    assert ex.find("b")['value'] == 2
    assert ex.remove("b") == True
    assert ex.find("b") is None
    stats = ex.stats()
    assert stats['total_items'] == 2
    print("応用テスト全合格!")
 
test_advanced()

# 演習3: パフォーマンス最適化
import time
from functools import lru_cache
 
# 最適化前（O(n^2)）
def slow_search(data: list, target: int) -> int:
    """非効率な検索"""
    for i in range(len(data)):
        for j in range(i + 1, len(data)):
            if data[i] + data[j] == target:
                return (i, j)
    return (-1, -1)
 
# 最適化後（O(n)）
def fast_search(data: list, target: int) -> tuple:
    """ハッシュマップを使った効率的な検索"""
    seen = {}
    for i, num in enumerate(data):
        complement = target - num
        if complement in seen:
            return (seen[complement], i)
        seen[num] = i
    return (-1, -1)
 
# ベンチマーク
def benchmark():
    import random
    data = list(range(5000))
    random.shuffle(data)
    target = data[100] + data[4000]
 
    start = time.time()
    result1 = slow_search(data, target)
    slow_time = time.time() - start
 
    start = time.time()
    result2 = fast_search(data, target)
    fast_time = time.time() - start
 
    print(f"非効率版: {slow_time:.4f}秒")
    print(f"効率版:   {fast_time:.6f}秒")
    print(f"高速化率: {slow_time/fast_time:.0f}倍")
 
benchmark()

# デバッグ用ユーティリティ
import logging
import traceback
from functools import wraps
 
# ロガーの設定
logging.basicConfig(
    level=logging.DEBUG,
    format='%(asctime)s [%(levelname)s] %(name)s: %(message)s'
)
logger = logging.getLogger(__name__)
 
def debug_decorator(func):
    """関数の入出力をログ出力するデコレータ"""
    @wraps(func)
    def wrapper(*args, **kwargs):
        logger.debug(f"呼び出し: {func.__name__}(args={args}, kwargs={kwargs})")
        try:
            result = func(*args, **kwargs)
            logger.debug(f"戻り値: {func.__name__} -> {result}")
            return result
        except Exception as e:
            logger.error(f"例外発生: {func.__name__}: {e}")
            logger.error(traceback.format_exc())
            raise
    return wrapper
 
@debug_decorator
def process_data(items):
    """データ処理（デバッグ対象）"""
    if not items:
        raise ValueError("空のデータ")
    return [item * 2 for item in items]

# 設計判断の記録テンプレート
class ArchitectureDecisionRecord:
    """ADR (Architecture Decision Record) の作成"""
 
    def __init__(self, title: str):
        self.title = title
        self.context = ""
        self.decision = ""
        self.consequences = []
        self.alternatives = []
 
    def set_context(self, context: str):
        """背景と課題の記述"""
        self.context = context
        return self
 
    def set_decision(self, decision: str):
        """決定内容の記述"""
        self.decision = decision
        return self
 
    def add_consequence(self, consequence: str, positive: bool = True):
        """結果の追加"""
        self.consequences.append({
            'description': consequence,
            'type': 'positive' if positive else 'negative'
        })
        return self
 
    def add_alternative(self, name: str, reason_rejected: str):
        """却下した代替案の追加"""
        self.alternatives.append({
            'name': name,
            'reason_rejected': reason_rejected
        })
        return self
 
    def to_markdown(self) -> str:
        """Markdown形式で出力"""
        md = f"# ADR: {self.title}\n\n"
        md += f"## 背景\n{self.context}\n\n"
        md += f"## 決定\n{self.decision}\n\n"
        md += "## 結果\n"
        for c in self.consequences:
            icon = "✅" if c['type'] == 'positive' else "⚠️"
            md += f"- {icon} {c['description']}\n"
        md += "\n## 却下した代替案\n"
        for a in self.alternatives:
            md += f"- **{a['name']}**: {a['reason_rejected']}\n"
        return md