Amazon ECR
A fully managed container registry for securely storing, managing, and deploying Docker container images
Overview
Amazon Elastic Container Registry (ECR) is a fully managed registry for storing and managing Docker container images and OCI artifacts. It integrates natively with AWS container services like ECS, EKS, and Lambda, and supports image push/pull through VPC endpoints without traversing the internet. Features include vulnerability scanning (Amazon Inspector integration), image signing for tamper detection, and lifecycle policies for automatic cleanup of old images.
The Roles of Private and Public Registries
ECR offers two types of registries. Private registries control access via IAM policies and are used for securely managing internal application images. Repository policies can grant cross-account pull access, enabling a shared base image distribution model in multi-account environments. The public registry (ECR Public Gallery) is for distributing open-source project and public tool images, serving as an alternative to Docker Hub. According to the official pricing page, storage and data transfer are billed on a pay-per-use basis, and data transferred to AWS services within the same Region is free of charge (as of October 2026). Unlike Azure Container Registry, which follows a SKU-based pricing model with fixed monthly fees, ECR has no fixed tier fees.
Storage Management with Lifecycle Policies
A key operational task in ECR is configuring lifecycle policies. In environments where CI/CD pipelines frequently push images, untagged and outdated images accumulate and inflate storage costs. Lifecycle policies with rules like 'delete untagged images after 1 day' and 'retain only the latest 10 tagged images' automate cleanup. Priority-based rule ordering lets you combine multiple criteria - for example, keeping the latest 5 production-tagged images while aggressively pruning development builds. Unlike Azure Container Registry, which offers a built-in build feature (ACR Tasks), ECR has no in-registry build capability and relies on external CI/CD services like CodeBuild or GitHub Actions, keeping the registry focused purely on storage and distribution.
Vulnerability Scanning and Multi-Account Operations
For security, enabling Enhanced Scanning (Amazon Inspector integration) rescans existing images when new CVEs are published, not just at push time, providing continuous vulnerability detection. Scan results are surfaced in the ECR console, and scan events are also sent to EventBridge. Container images in ECR can be signed with AWS Signer. In multi-account environments, you can use a Hub-Spoke architecture that centralizes ECR repositories in a shared services account and grants pull access to workload accounts via repository policies. Replication settings can automatically copy images to repositories in other regions or accounts, which helps reduce pull latency and prepare for disaster recovery.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon ECS official page
- Amazon EKS official page
- AWS Fargate official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.