Overview

An Artifact Registry is a collection of container image repositories with shared identity and access control. You provision one per stack; Alien and the build pipeline manage the repositories inside it.

ArtifactRegistry("images")           ← provisioned once (IAM roles, cloud registry, etc.)
  ├── images/app-a                    ← repositories created as your images are built and pushed
  ├── images/app-b
  └── images/app-c

Each platform maps this to its native container registry service:

Platform Mapping

When to Use

Provision an Artifact Registry when your stack builds and runs container images — for example Containers and Daemons — and you want Alien to own the registry, its IAM, and cross-account image distribution.

Provisioning

Declare the registry in your stack. The builder is cloud-agnostic; replicationRegions is the only configurable option and applies to AWS ECR only.

// alien.ts
const images = new alien.ArtifactRegistry("images")
  .replicationRegions(["us-west-2", "eu-west-1"])  // AWS only
  .build()

Cross-Account Access

On AWS and GCP, Alien can grant other cloud accounts permission to pull images from the registry — useful when compute in a different account needs to run your images. Cross-account pull access is not supported on Azure through Alien. See Behavior & Limits for how access grants are scoped and isolated.