Docker image management update 🐦 (#22)

* remove docker dep and use dockerless provider for pulling and pushing images * NBS configuration update (#21) * update phdi version * set app_env to prod and add nbs_pub_key * add NEXTAUTH_URL * update phdi_version to 1.6.8 * Set hostname to 0.0.0.0 * Remove NODE_ENV from ecr-viewer * update phdi version to 1.6.9 * make APP_ENV and NBS_PUB_KEY variables * run format and generate docs * Set default to 1.6.9 --------- Co-authored-by: Boban Ljuljdjurovic <[email protected]> --------- Co-authored-by: Boban Ljuljdjurovic <[email protected]>
CDCgov · Oct 3, 2024 · 497543f · 497543f
1 parent e17c22b
commit 497543f
Show file tree

Hide file tree

Showing 10 changed files with 75 additions and 104 deletions.
diff --git a/terraform/implementation/ecs/README.md b/terraform/implementation/ecs/README.md
@@ -9,7 +9,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.56.1 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | =5.56.1 |
 
 ## Modules
 
@@ -28,16 +28,16 @@
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | The availability zones to use | `list(string)` | <pre>[<br>  "us-east-1a",<br>  "us-east-1b",<br>  "us-east-1c"<br>]</pre> | no |
+| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | The availability zones to use | `list(string)` | <pre>[<br/>  "us-east-1a",<br/>  "us-east-1b",<br/>  "us-east-1c"<br/>]</pre> | no |
 | <a name="input_ecr_viewer_database_schema"></a> [ecr\_viewer\_database\_schema](#input\_ecr\_viewer\_database\_schema) | The database schema used for the eCR data tables | `string` | `"core"` | no |
 | <a name="input_ecr_viewer_database_type"></a> [ecr\_viewer\_database\_type](#input\_ecr\_viewer\_database\_type) | The SQL variant used for the eCR data tables | `string` | `"postgres"` | no |
 | <a name="input_ecs_alb_sg"></a> [ecs\_alb\_sg](#input\_ecs\_alb\_sg) | The security group for the Application Load Balancer | `string` | `"ecs-albsg"` | no |
 | <a name="input_enable_nat_gateway"></a> [enable\_nat\_gateway](#input\_enable\_nat\_gateway) | Enable NAT Gateway | `bool` | `true` | no |
 | <a name="input_owner"></a> [owner](#input\_owner) | The owner of the infrastructure | `string` | `"skylight"` | no |
 | <a name="input_phdi_version"></a> [phdi\_version](#input\_phdi\_version) | PHDI container image version | `string` | `"v1.4.4"` | no |
-| <a name="input_private_subnets"></a> [private\_subnets](#input\_private\_subnets) | The private subnets | `list(string)` | <pre>[<br>  "176.24.1.0/24",<br>  "176.24.3.0/24"<br>]</pre> | no |
+| <a name="input_private_subnets"></a> [private\_subnets](#input\_private\_subnets) | The private subnets | `list(string)` | <pre>[<br/>  "176.24.1.0/24",<br/>  "176.24.3.0/24"<br/>]</pre> | no |
 | <a name="input_project"></a> [project](#input\_project) | The project name | `string` | `"dibbs-ce"` | no |
-| <a name="input_public_subnets"></a> [public\_subnets](#input\_public\_subnets) | The public subnets | `list(string)` | <pre>[<br>  "176.24.2.0/24",<br>  "176.24.4.0/24"<br>]</pre> | no |
+| <a name="input_public_subnets"></a> [public\_subnets](#input\_public\_subnets) | The public subnets | `list(string)` | <pre>[<br/>  "176.24.2.0/24",<br/>  "176.24.4.0/24"<br/>]</pre> | no |
 | <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | `"us-east-1"` | no |
 | <a name="input_single_nat_gateway"></a> [single\_nat\_gateway](#input\_single\_nat\_gateway) | Single NAT Gateway | `bool` | `true` | no |
 | <a name="input_vpc"></a> [vpc](#input\_vpc) | The name of the VPC | `string` | `"ecs-vpc"` | no |

diff --git a/terraform/implementation/ecs/deploy.sh b/terraform/implementation/ecs/deploy.sh
@@ -113,6 +113,7 @@ echo "Bucket: $BUCKET"
 echo "DynamoDB Table: $DYNAMODB_TABLE"
 echo "Region: $REGION"
 cat "$ENVIRONMENT.tfvars"
+echo ""
 
 terraform init \
     -var-file="$ENVIRONMENT.tfvars" \

diff --git a/terraform/implementation/ecs/main.tf b/terraform/implementation/ecs/main.tf
@@ -23,7 +23,9 @@ module "ecs" {
   owner   = var.owner
   project = var.project
   tags    = local.tags
-
-  # If intent is to use the non-integrated viewer, set this to true (default is false)
-  # non_integrated_viewer = "true"
+
+  # If intent is to pull from the phdi GHCR, set disable_ecr to true (default is false)
+  # disable_ecr = true
+  # If intent is to use the non-integrated viewer, set non_integrated_viewer to true (default is false)
+  non_integrated_viewer = "true"
 }
diff --git a/terraform/implementation/setup/README.md b/terraform/implementation/setup/README.md
@@ -7,9 +7,9 @@ No requirements.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.57.0 |
-| <a name="provider_local"></a> [local](#provider\_local) | 2.5.1 |
-| <a name="provider_random"></a> [random](#provider\_random) | 3.6.2 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+| <a name="provider_local"></a> [local](#provider\_local) | n/a |
+| <a name="provider_random"></a> [random](#provider\_random) | n/a |
 
 ## Modules
 

diff --git a/terraform/modules/ecs/README.md b/terraform/modules/ecs/README.md
@@ -3,14 +3,14 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_docker"></a> [docker](#requirement\_docker) | 3.0.2 |
+| <a name="requirement_dockerless"></a> [dockerless](#requirement\_dockerless) | 0.1.1 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
 | <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
-| <a name="provider_docker"></a> [docker](#provider\_docker) | 3.0.2 |
+| <a name="provider_dockerless"></a> [dockerless](#provider\_dockerless) | 0.1.1 |
 | <a name="provider_null"></a> [null](#provider\_null) | n/a |
 | <a name="provider_random"></a> [random](#provider\_random) | n/a |
 
@@ -51,10 +51,7 @@ No modules.
 | [aws_security_group_rule.ecs_all_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
 | [aws_security_group_rule.ecs_ecs_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
 | [aws_service_discovery_private_dns_namespace.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/service_discovery_private_dns_namespace) | resource |
-| [docker_image.dibbs](https://registry.terraform.io/providers/kreuzwerker/docker/3.0.2/docs/resources/image) | resource |
-| [docker_registry_image.this](https://registry.terraform.io/providers/kreuzwerker/docker/3.0.2/docs/resources/registry_image) | resource |
-| [docker_tag.this](https://registry.terraform.io/providers/kreuzwerker/docker/3.0.2/docs/resources/tag) | resource |
-| [null_resource.docker_tag](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
+| [dockerless_remote_image.dibbs](https://registry.terraform.io/providers/nullstone-io/dockerless/0.1.1/docs/resources/remote_image) | resource |
 | [null_resource.target_groups](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [random_string.s3_viewer](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
@@ -63,7 +60,6 @@ No modules.
 | [aws_iam_policy.ecs_task_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |
 | [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.ecr_viewer_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
-| [docker_registry_image.dibbs](https://registry.terraform.io/providers/kreuzwerker/docker/3.0.2/docs/data-sources/registry_image) | data source |
 
 ## Inputs
 
@@ -75,6 +71,9 @@ No modules.
 | <a name="input_cloudmap_service_name"></a> [cloudmap\_service\_name](#input\_cloudmap\_service\_name) | Name of the AWS Cloud Map service | `string` | `""` | no |
 | <a name="input_cw_retention_in_days"></a> [cw\_retention\_in\_days](#input\_cw\_retention\_in\_days) | Retention period in days for CloudWatch logs | `number` | `30` | no |
 | <a name="input_disable_ecr"></a> [disable\_ecr](#input\_disable\_ecr) | Flag to disable the aws ecr service for docker image storage, defaults to false | `bool` | `false` | no |
+| <a name="input_ecr_viewer_app_env"></a> [ecr\_viewer\_app\_env](#input\_ecr\_viewer\_app\_env) | The current environment that is running. This may modify behavior of auth between dev and prod. | `string` | `"prod"` | no |
+| <a name="input_ecr_viewer_auth_pub_key"></a> [ecr\_viewer\_auth\_pub\_key](#input\_ecr\_viewer\_auth\_pub\_key) | The public key used to validate the incoming authenication for the eCR Viewer. | `string` | `"-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqjrH9PprQCB5dX15zYfd\nS6K2ezNi/ZOu8vKEhQuLqwHACy1iUt1Yyp2PZLIV7FVDgBHMMVWPVx3GJ2wEyaJw\nMHkv6XNpUpWLhbs0V1T7o/OZfEIqcNua07OEoBxX9vhKIHtaksWdoMyKRXQJz0js\noWpawfOWxETnLqGvybT4yvY2RJhquTXLcLu90L4LdvIkADIZshaOtAU/OwI5ATcb\nfE3ip15E6jIoUm7FAtfRiuncpI5l/LJPP6fvwf8QCbbUJBZklLqcUuf4qe/L/nIq\npIONb8KZFWPhnGeRZ9bwIcqYWt3LAAshQLSGEYl2PGXaqbkUD2XLETSKDjisxd0g\n9j8bIMPgBKi+dBYcmBZnR7DxJe+vEDDw8prHG/+HRy5fim/BcibTKnIl8PR5yqHa\nmWQo7N+xXhILdD9e33KLRgbg97+erHqvHlNMdwDhAfrBT+W6GCdPwp3cePPsbhsc\noGSHOUDhzyAujr0J8h5WmZDGUNWjGzWqubNZD8dBXB8x+9dDoWhfM82nw0pvAeKf\nwJodvn3Qo8/S5hxJ6HyGkUTANKN8IxWh/6R5biET5BuztZP6jfPEaOAnt6sq+C38\nhR9rUr59dP2BTlcJ19ZXobLwuJEa81S5BrcbDwYNOAzC8jl2EV1i4bQIwJJaY27X\nIynom6unaheZpS4DFIh2w9UCAwEAAQ==\n-----END PUBLIC KEY-----\n"` | no |
+| <a name="input_ecr_viewer_basepath"></a> [ecr\_viewer\_basepath](#input\_ecr\_viewer\_basepath) | The basepath for the ecr-viewer | `string` | `"/ecr-viewer"` | no |
 | <a name="input_ecs_alb_name"></a> [ecs\_alb\_name](#input\_ecs\_alb\_name) | Name of the Application Load Balancer (ALB) | `string` | `""` | no |
 | <a name="input_ecs_alb_sg"></a> [ecs\_alb\_sg](#input\_ecs\_alb\_sg) | Name of the ECS ALB Security Group | `string` | `""` | no |
 | <a name="input_ecs_alb_tg_name"></a> [ecs\_alb\_tg\_name](#input\_ecs\_alb\_tg\_name) | Name of the ALB Target Group | `string` | `""` | no |
@@ -84,14 +83,14 @@ No modules.
 | <a name="input_ecs_task_role_name"></a> [ecs\_task\_role\_name](#input\_ecs\_task\_role\_name) | Name of the ECS Task Role | `string` | `""` | no |
 | <a name="input_non_integrated_viewer"></a> [non\_integrated\_viewer](#input\_non\_integrated\_viewer) | A flag to determine if the viewer is the non-integrated version | `string` | `"false"` | no |
 | <a name="input_owner"></a> [owner](#input\_owner) | Owner of the resources | `string` | `"CDC"` | no |
-| <a name="input_phdi_version"></a> [phdi\_version](#input\_phdi\_version) | Version of the PHDI application | `string` | `"v1.6.1"` | no |
+| <a name="input_phdi_version"></a> [phdi\_version](#input\_phdi\_version) | Version of the PHDI application | `string` | `"v1.6.4"` | no |
 | <a name="input_private_subnet_ids"></a> [private\_subnet\_ids](#input\_private\_subnet\_ids) | List of private subnet IDs | `list(string)` | n/a | yes |
 | <a name="input_project"></a> [project](#input\_project) | The project name | `string` | `"dibbs"` | no |
 | <a name="input_public_subnet_ids"></a> [public\_subnet\_ids](#input\_public\_subnet\_ids) | List of public subnet IDs | `list(string)` | n/a | yes |
 | <a name="input_region"></a> [region](#input\_region) | The AWS region where resources are created | `string` | n/a | yes |
 | <a name="input_s3_viewer_bucket_name"></a> [s3\_viewer\_bucket\_name](#input\_s3\_viewer\_bucket\_name) | Name of the S3 bucket for the viewer | `string` | `""` | no |
 | <a name="input_s3_viewer_bucket_role_name"></a> [s3\_viewer\_bucket\_role\_name](#input\_s3\_viewer\_bucket\_role\_name) | Name of the IAM role for the ecr-viewer bucket | `string` | `""` | no |
-| <a name="input_service_data"></a> [service\_data](#input\_service\_data) | Data for the DIBBS services | <pre>map(object({<br>    short_name     = string<br>    fargate_cpu    = number<br>    fargate_memory = number<br>    app_count      = number<br>    app_image      = string<br>    app_version    = string<br>    container_port = number<br>    host_port      = number<br>    public         = bool<br>    registry_url   = string<br>    env_vars = list(object({<br>      name  = string<br>      value = string<br>    }))<br>  }))</pre> | `{}` | no |
+| <a name="input_service_data"></a> [service\_data](#input\_service\_data) | Data for the DIBBS services | <pre>map(object({<br/>    short_name     = string<br/>    fargate_cpu    = number<br/>    fargate_memory = number<br/>    app_count      = number<br/>    app_image      = string<br/>    app_version    = string<br/>    container_port = number<br/>    host_port      = number<br/>    public         = bool<br/>    registry_url   = string<br/>    env_vars = list(object({<br/>      name  = string<br/>      value = string<br/>    }))<br/>  }))</pre> | `{}` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags to apply to resources | `map(string)` | `{}` | no |
 | <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | ID of the VPC | `string` | n/a | yes |
 

diff --git a/terraform/modules/ecs/_local.tf b/terraform/modules/ecs/_local.tf
@@ -15,7 +15,7 @@ locals {
       fargate_cpu    = 1024,
       fargate_memory = 2048,
       app_count      = 1
-      app_image      = "${terraform.workspace}-ecr-viewer",
+      app_image      = var.disable_ecr == false ? "${terraform.workspace}-ecr-viewer" : "ecr-viewer",
       app_version    = var.phdi_version,
       container_port = 3000,
       host_port      = 3000,
@@ -32,7 +32,7 @@ locals {
         },
         {
           name  = "HOSTNAME",
-          value = "127.0.0.1"
+          value = "0.0.0.0"
         },
         {
           name  = "NEXT_PUBLIC_NON_INTEGRATED_VIEWER",
@@ -44,14 +44,14 @@ locals {
         },
         {
           name  = "APP_ENV",
-          value = "test"
+          value = var.ecr_viewer_app_env
         },
         {
-          name  = "NODE_ENV",
-          value = var.node_env
+          name  = "NBS_PUB_KEY",
+          value = var.ecr_viewer_auth_pub_key
         },
         {
-          name = "NEXT_PUBLIC_BASEPATH",
+          name  = "NEXT_PUBLIC_BASEPATH",
           value = var.ecr_viewer_basepath
         }
       ]
@@ -61,7 +61,7 @@ locals {
       fargate_cpu    = 1024,
       fargate_memory = 2048,
       app_count      = 1
-      app_image      = "${terraform.workspace}-fhir-converter",
+      app_image      = var.disable_ecr == false ? "${terraform.workspace}-fhir-converter" : "fhir-converter",
       app_version    = var.phdi_version,
       container_port = 8080,
       host_port      = 8080,
@@ -74,7 +74,7 @@ locals {
       fargate_cpu    = 1024,
       fargate_memory = 2048,
       app_count      = 1
-      app_image      = "${terraform.workspace}-ingestion",
+      app_image      = var.disable_ecr == false ? "${terraform.workspace}-ingestion" : "ingestion",
       app_version    = var.phdi_version,
       container_port = 8080,
       host_port      = 8080,
@@ -87,7 +87,7 @@ locals {
       fargate_cpu    = 1024,
       fargate_memory = 2048,
       app_count      = 1
-      app_image      = "${terraform.workspace}-validation",
+      app_image      = var.disable_ecr == false ? "${terraform.workspace}-validation" : "validation",
       app_version    = var.phdi_version,
       container_port = 8080,
       host_port      = 8080,
@@ -100,7 +100,7 @@ locals {
       fargate_cpu    = 1024,
       fargate_memory = 2048,
       app_count      = 1
-      app_image      = "${terraform.workspace}-trigger-code-reference",
+      app_image      = var.disable_ecr == false ? "${terraform.workspace}-trigger-code-reference" : "trigger-code-reference",
       app_version    = var.phdi_version,
       container_port = 8080,
       host_port      = 8080,
@@ -113,7 +113,7 @@ locals {
       fargate_cpu    = 1024,
       fargate_memory = 2048,
       app_count      = 1
-      app_image      = "${terraform.workspace}-message-parser",
+      app_image      = var.disable_ecr == false ? "${terraform.workspace}-message-parser" : "message-parser",
       app_version    = var.phdi_version,
       container_port = 8080,
       host_port      = 8080,
@@ -126,7 +126,7 @@ locals {
       fargate_cpu    = 1024,
       fargate_memory = 2048,
       app_count      = 1
-      app_image      = "${terraform.workspace}-orchestration",
+      app_image      = var.disable_ecr == false ? "${terraform.workspace}-orchestration" : "orchestration",
       app_version    = var.phdi_version,
       container_port = 8080,
       host_port      = 8080,

diff --git a/terraform/modules/ecs/_variable.tf b/terraform/modules/ecs/_variable.tf
@@ -99,7 +99,7 @@ variable "s3_viewer_bucket_role_name" {
 variable "phdi_version" {
   type        = string
   description = "Version of the PHDI application"
-  default     = "v1.6.4"
+  default     = "v1.6.9"
 }
 
 variable "service_data" {
@@ -158,14 +158,35 @@ variable "non_integrated_viewer" {
   default     = "false"
 }
 
-variable "node_env" {
-  type        = string
-  description = "The app node environment"
-  default     = "production"
-}
-
 variable "ecr_viewer_basepath" {
   type        = string
   description = "The basepath for the ecr-viewer"
   default     = "/ecr-viewer"
-}
+}
+
+variable "ecr_viewer_app_env" {
+  type        = string
+  description = "The current environment that is running. This may modify behavior of auth between dev and prod."
+  default     = "prod"
+}
+
+variable "ecr_viewer_auth_pub_key" {
+  type        = string
+  description = "The public key used to validate the incoming authenication for the eCR Viewer."
+  default     = <<EOT
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqjrH9PprQCB5dX15zYfd
+S6K2ezNi/ZOu8vKEhQuLqwHACy1iUt1Yyp2PZLIV7FVDgBHMMVWPVx3GJ2wEyaJw
+MHkv6XNpUpWLhbs0V1T7o/OZfEIqcNua07OEoBxX9vhKIHtaksWdoMyKRXQJz0js
+oWpawfOWxETnLqGvybT4yvY2RJhquTXLcLu90L4LdvIkADIZshaOtAU/OwI5ATcb
+fE3ip15E6jIoUm7FAtfRiuncpI5l/LJPP6fvwf8QCbbUJBZklLqcUuf4qe/L/nIq
+pIONb8KZFWPhnGeRZ9bwIcqYWt3LAAshQLSGEYl2PGXaqbkUD2XLETSKDjisxd0g
+9j8bIMPgBKi+dBYcmBZnR7DxJe+vEDDw8prHG/+HRy5fim/BcibTKnIl8PR5yqHa
+mWQo7N+xXhILdD9e33KLRgbg97+erHqvHlNMdwDhAfrBT+W6GCdPwp3cePPsbhsc
+oGSHOUDhzyAujr0J8h5WmZDGUNWjGzWqubNZD8dBXB8x+9dDoWhfM82nw0pvAeKf
+wJodvn3Qo8/S5hxJ6HyGkUTANKN8IxWh/6R5biET5BuztZP6jfPEaOAnt6sq+C38
+hR9rUr59dP2BTlcJ19ZXobLwuJEa81S5BrcbDwYNOAzC8jl2EV1i4bQIwJJaY27X
+Iynom6unaheZpS4DFIh2w9UCAwEAAQ==
+-----END PUBLIC KEY-----
+          EOT
+}
diff --git a/terraform/modules/ecs/ecs.tf b/terraform/modules/ecs/ecs.tf
@@ -14,7 +14,7 @@ resource "aws_ecs_task_definition" "this" {
   container_definitions = jsonencode([
     {
       name        = each.key,
-      image       = "${each.value.registry_url}/${each.value.app_image}:${each.value.app_version}",
+      image       = var.disable_ecr == false ? dockerless_remote_image.dibbs[each.key].target : "${each.value.registry_url}/${each.value.app_image}:${each.value.app_version}",
       networkMode = "awsvpc",
       logConfiguration = {
         logDriver = "awslogs",

diff --git a/terraform/modules/ecs/enable_ecr.tf b/terraform/modules/ecs/enable_ecr.tf
@@ -1,47 +1,7 @@
-data "docker_registry_image" "dibbs" {
+resource "dockerless_remote_image" "dibbs" {
   for_each = var.disable_ecr == false ? local.service_data : {}
-  name     = "ghcr.io/cdcgov/phdi/${each.key}:${each.value.app_version}"
-}
-
-resource "docker_image" "dibbs" {
-  for_each      = var.disable_ecr == false ? local.service_data : {}
-  name          = data.docker_registry_image.dibbs[each.key].name
-  keep_locally  = true
-  pull_triggers = [data.docker_registry_image.dibbs[each.key].sha256_digest, plantimestamp()]
-  force_remove  = true
-}
-
-resource "docker_tag" "this" {
-  for_each     = var.disable_ecr == false ? local.service_data : {}
-  source_image = docker_image.dibbs[each.key].name
-  target_image = "${each.value.registry_url}/${each.value.app_image}:${each.value.app_version}"
-  lifecycle {
-    replace_triggered_by = [
-      null_resource.docker_tag
-    ]
-  }
-}
-
-resource "docker_registry_image" "this" {
-  for_each = var.disable_ecr == false ? local.service_data : {}
-  name     = "${each.value.registry_url}/${each.value.app_image}:${each.value.app_version}"
-  depends_on = [
-    docker_image.dibbs,
-    docker_tag.this,
-    aws_ecr_repository.this
-  ]
-  keep_remotely = true
-
-  triggers = {
-    sha256_digest = data.docker_registry_image.dibbs[each.key].sha256_digest
-  }
-}
-
-resource "null_resource" "docker_tag" {
-  for_each = docker_image.dibbs
-  triggers = {
-    docker_image = each.value.id
-  }
+  source   = "ghcr.io/cdcgov/phdi/${each.key}:${each.value.app_version}"
+  target   = "${each.value.registry_url}/${each.value.app_image}:${each.value.app_version}"
 }
 
 data "aws_ecr_authorization_token" "this" {}