Amazon ECR

What it is

Amazon Elastic Container Registry (Amazon ECR) is a managed container image registry. You push Docker and OCI (Open Container Initiative) images to it from your build pipeline, and Amazon ECS, Amazon EKS, AWS Lambda, and other services pull them when they start containers. There are no registry servers to run, scale, or back up.

ECR has two kinds of repositories:

Private repositories, controlled with IAM, for your own applications.
Public repositories (ECR Public), for images you share with everyone.

Concepts and features

Registry and repositories: each account has a private registry per AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry, containing repositories that hold the versions of an image, identified by tags such as v1.4 or by digest.
Authentication: Docker clients log in with an authorization token, valid for 12 hours, obtained with aws ecr get-login-password. ECS and EKS handle this for you.
Repository policies: Resource-based policyA permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.Glossary entry that control who can push and pull. By default, only the account that created a repository can access it; a repository policy can grant another account or an organization access.
Lifecycle policies: rules that expire old images automatically, or move them to the lower-cost archive storage class, for example keeping only the last 30 images or deleting untagged images after 14 days. Test them in preview first.
Tag immutability: stops a tag from being overwritten, so v1.4 always means the same image. Pushing an existing tag then fails.
Image scanning:
- Basic scanning checks the operating system packages for known vulnerabilities (CVEs), on push or on demand.
- Enhanced scanning uses Amazon Inspector to scan operating system and programming language packages, on push and continuously as new vulnerabilities are published, and sends findings to Amazon EventBridge.
Replication: copy images automatically to other Regions or other accounts, for multi-Region deployments, lower pull LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry, and DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry.
Pull through cache: cache images from an upstream registry, such as a public registry or another ECR private registry, in your private registry, so builds and deployments don't depend on the upstream registry. An image is cached only when it is first pulled, so pull through cache doesn't replace replication for disaster recovery: images never pulled in the standby Region would still need the failed Region.
Managed signing signs images automatically when they are pushed.

Security, resilience, performance, and cost

Security

IAM policies and repository policies control push and pull. Grant the ECS task execution role or the EKS node role permission to pull images.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry is always on: SSE (Server-side encryption)Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.Glossary entry-S3 (AES-256) by default, or SSE-KMS with the AWS managed key or a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry. The encryption setting is chosen when the repository is created and cannot be changed afterwards.
Private access: interface VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry for ecr.api and ecr.dkr, plus an S3 gateway endpoint (image layers are stored in S3), let tasks and nodes in SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry pull images without a NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry or internet access.
Turn on enhanced scanning and tag immutability, and use lifecycle policies so old, vulnerable images don't linger.

Resilience

ECR is a Regional service that stores images durably. For Regional resilience, replicate images to a second Region so workloads there can still pull them.
Pull through cache protects deployments from outages or rate limits of upstream public registries.

Performance

Pull images from ECR in the same Region as the workload for the fastest starts; replicate to every Region where you run containers.
Keep images small so tasks and pods start faster.

Cost

You pay for storage per GB-month and for data transfer out. Data transfer from ECR to EC2, ECS, Fargate, Lambda, and other services in the same Region is free; transfer across Regions and to the internet is charged.
Lifecycle policies reduce storage by removing old images.
A private-repository free tier covers 500 MB a month for new customers for a year; public repositories include 50 GB of free storage. Enhanced scanning is billed through Amazon Inspector.

Monitoring

AWS CloudTrail records ECR API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls, including pushes and pulls.
Amazon EventBridge receives events such as completed image pushes and scan results, so a rule can start a deployment or alert on new vulnerabilities.
CloudWatch usage metrics track repository and API usage against quotas.

ECR or another option?

If the requirement is	Choose
Private container images for ECS, EKS, or Lambda	Amazon ECR private repository
Share images publicly	Amazon ECR Public
Cache images from a public registry to avoid its limits and outages	ECR pull through cache
Store other build artifacts and packages, such as npm or Maven	AWS CodeArtifact
Store files or backups	Amazon S3

Reverse mindmap: when the question points here

Is it Amazon ECR?

Yes, when the question says
- Private registry for container images leads to Amazon ECR
- Find vulnerabilities in images, including language packages leads to Enhanced scanning with Inspector
- Rescan images when new CVEs appear leads to Continuous scanning
- Delete old and untagged images automatically leads to Lifecycle policy
- Prevent a release tag being overwritten leads to Tag immutability
Share and replicate
- Another account must pull the images leads to Repository policy
- Same images in a second Region leads to Cross-Region replication
- Standby Region must pull images when the primary Region fails leads to Replication, not pull through cache
- Avoid public registry rate limits leads to Pull through cache
Secure it
- Pull images from private subnets without NAT leads to ECR interface endpoints and S3 gateway endpoint
- Encrypt with your own key leads to SSE-KMS chosen at repository creation
No, when the question says
- Store npm or Maven packages leads to AWS CodeArtifact
- Run the containers leads to Amazon ECS or Amazon EKS

Key takeaways

ECR stores container images in private (IAM-controlled) or public repositories.
Repository policies grant cross-account access; lifecycle policies clean up; tag immutability protects release tags.
Basic scanning covers OS packages; enhanced scanning with Inspector adds language packages and continuous scanning.
Replicate images across Regions and accounts; use pull through cache for upstream registries.
Encryption is set at creation; private subnets need ECR interface endpoints plus an S3 gateway endpoint; same-Region pulls are free.