Amazon Elastic Container Registry

Service for storing container images on AWS.

Amazon ECR is a container registry service for storing and managing Docker container images.

• Image storage for ECS
• Image storage for App Runner
• Storing containers built by CI/CD

• Storage location for container images
• Combined with ECS and EKS
• Usable as a private registry

• Image scanning detects vulnerabilities
• Use lifecycle policies to remove old images
• Integrates with CI/CD pipelines

Amazon ECR (Elastic Container Registry) is a fully managed container registry service that stores and manages Docker container images and OCI-format artifacts. It provides two types of registries: private registries (closed for sharing within an account / IAM) and public registries (open to the internet). It integrates closely with AWS container execution platforms such as ECS, EKS, App Runner, and Lambda (running container images). From the Docker CLI, it can be operated with `docker push` / `docker pull` like an ordinary registry, with authentication using temporary tokens issued via IAM. Typical use cases in practice include image push from CI/CD pipelines and automatic pull from ECS / EKS tasks. The flow involves building images with CodeBuild or GitHub Actions, pushing them to ECR, and having the ECS service update pull the latest image from ECR into the new task definition for execution. ECR provides image scanning features (Basic scanning and Enhanced scanning) that automatically detect and notify of known vulnerabilities (CVEs) at push time. By setting lifecycle policies, you can automatically delete old images (based on tag count or creation date) to prevent storage cost bloat. In security operations, repository policies (resource-based IAM) control which IAM principals can push or pull to prevent unauthorized writes to production images. It is fundamental to not include API keys, `.env` files, or private keys in container images (inject them at runtime from environment variables, Secrets Manager, or Parameter Store). CLF-C02 asks questions such as "a service that stores container images" and "a registry to combine with ECS / EKS", while SAA-C03 and beyond ask in depth about integration of Enhanced scanning with Amazon Inspector, cross-account replication, and image pull via private endpoints (VPC endpoints).

• Amazon ECR (AWS Official)
• What is Amazon ECR (AWS Official Documentation)
• Amazon ECR Image Scanning (AWS Official Documentation)

Last updated: 2026-06-07