Container Registry

Amazon Elastic Container Registry (ECR) is a fully managed Docker container registry that integrates with ECS, EKS, and Lambda. It stores, manages, and deploys container images.

Create a repository via the CLI:

aws ecr create-repository \
  --repository-name myapp-api \
  --image-scanning-configuration scanOnPush=true \
  --encryption-configuration encryptionType=AES256 \
  --region us-east-1

Authenticate Docker with ECR:

aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com

Tag and push an image:

docker tag myapp:latest 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp-api:v1.0.0
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp-api:v1.0.0

ECR stores images in multiple layers using the same format as Docker, so pushing only uploads layers not already in the registry. This makes pushes fast when only a few layers change. ECR lifecycle policies automatically clean up old images based on age, count, or tag status, reducing storage costs.

ECR integrates with Amazon Inspector to scan container images for vulnerabilities. Scanning can happen on push (automatic) or manually.

Enable on-push scanning at the repository level:

aws ecr put-image-scanning-configuration \
  --repository-name myapp-api \
  --image-scanning-configuration scanOnPush=true \
  --region us-east-1

Manually scan an image:

aws ecr start-image-scan \
  --repository-name myapp-api \
  --image-id imageTag=v1.0.0 \
  --region us-east-1

aws ecr describe-image-scan-findings \
  --repository-name myapp-api \
  --image-id imageTag=v1.0.0 \
  --region us-east-1

Vulnerabilities are classified as CRITICAL, HIGH, MEDIUM, or LOW. Integrate scanning into your CI/CD pipeline to block deployment of images with critical vulnerabilities. Use ECR pull-through cache to scan images from upstream registries like Docker Hub before they enter your environment.

Image tag immutability prevents overwriting tags, which is critical for production. Once v1.0.0 is pushed, it cannot be changed—this prevents supply chain attacks where a tag is overwritten with a malicious image.

aws ecr put-image-tag-mutability \
  --repository-name myapp-api \
  --image-tag-mutability IMMUTABLE

Cross-account access allows multiple AWS accounts to push and pull from the same ECR repository. This is essential in multi-account architectures where a shared services account manages container images.

Set a repository policy for cross-account access:

{
  "Statement": [
    {
      "Sid": "CrossAccountPull",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::456789012345:root"
      },
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:GetAuthorizationToken"
      ]
    }
  ]
}

Cross-region replication automatically copies images to ECR repositories in other regions. This is critical for disaster recovery and reducing latency for global deployments. Configure replication rules at the registry level:

aws ecr put-replication-configuration \
  --replication-configuration '{
    "rules": [{
      "destinations": [{
        "region": "us-west-2",
        "registryId": "123456789012"
      }],
      "repositoryFilters": [{
        "prefix": "myapp",
        "filterType": "PREFIX_MATCH"
      }]
    }]
  }'

ECR Public provides a public registry for sharing container images openly, similar to Docker Hub but with AWS infrastructure. Use it for open-source projects or public-facing applications.