Amazon Elastic Container Registry (ECR)

Fully managed Docker container registry for secure, scalable, and reliable image storage and deployment on AWS.

What is Amazon ECR?

Amazon Elastic Container Registry (Amazon ECR) is a fully managed Docker container registry service provided by AWS. It enables developers to store, manage, and deploy container images securely and at scale. ECR integrates seamlessly with Amazon Elastic Container Service (ECS), Amazon Elastic Kubernetes Service (EKS), AWS Lambda, and other AWS services, making it a core component of modern containerized application workflows.

With Amazon ECR, you can use familiar Docker CLI commands or AWS SDKs to push, pull, and manage container images. ECR supports private and public repositories, image vulnerability scanning, lifecycle policies, cross-region replication, and fine-grained access control using AWS IAM. It eliminates the need to operate your own container repositories or worry about scaling the underlying infrastructure.

Architecture

Key Components

Repositories

Logical collections of container images. ECR supports both private and public repositories, enabling secure storage and sharing of images.

Registry

The central service that manages repositories, image storage, access control, and integrations with other AWS services.

Image Scanning

Automated vulnerability scanning for container images, helping to identify and remediate security issues before deployment.

Key Capabilities

High Availability & Scalability

ECR is designed for high availability and can scale automatically to meet the needs of enterprise workloads.

Integrated Security

Supports IAM-based access control, encryption at rest, and automated image vulnerability scanning for secure image management.

Cross-Region Replication

Replicate container images across AWS regions to support multi-region deployments and disaster recovery strategies.

Common Use Cases

Storing and managing Docker container images

CI/CD pipelines for containerized applications

Multi-region image replication

Automated vulnerability scanning

Integration with ECS, EKS, and Lambda

Hybrid and multi-account architectures

Implementation Example

# AWS CLI Example: Create ECR Repository, Authenticate, Push Image

# 1. Create a new ECR repository
aws ecr create-repository --repository-name my-app-repo

# 2. Authenticate Docker to your ECR registry
aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin .dkr.ecr.us-east-1.amazonaws.com

# 3. Tag your Docker image

docker tag my-app:latest .dkr.ecr.us-east-1.amazonaws.com/my-app-repo:latest

# 4. Push the image to ECR

docker push .dkr.ecr.us-east-1.amazonaws.com/my-app-repo:latest

This example demonstrates how to create an ECR repository, authenticate Docker with ECR, tag a local Docker image, and push it to your ECR repository using the AWS CLI. Replace <aws_account_id> and region as appropriate.

Test Your Knowledge

Score 8/10 or higher to pass