Amazon Elastic Container Registry
Container image registry
A private store for Docker/OCI images, with vulnerability scanning, that ECS/EKS/Lambda pull from to run.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?A little
- Managed by AWS
- In examsSAA · DVA
Think of it asLike a mold warehouse: to cast a product (container), you take the mold (image) from here.
Where does ECR fit?
Calls ECR
ECRA real example, step by step
- Your team builds a Docker image of the API every time new code lands.
- The CI pipeline logs in to ECR with IAM permissions and pushes the image to the company's private repository.
- ECR scans the image for vulnerabilities as soon as it is pushed and flags risky libraries.
- ECS or EKS pulls the image from ECR in the same region, quickly and without going over the internet.
- A lifecycle policy deletes images older than the 30 most recent so storage costs don't keep growing.
When to use it
✓ Use it when
Storing images for apps running on AWS.
Common uses
- Store images for ECS, EKS, Lambda
- Scan images for security vulnerabilities
- Replicate images to other accounts or Regions
ECR, S3 or ECS?
S3What does it cost?
- Pricing model: ~$0.10/GB-month of storage + data transfer out of the Region or to the Internet. Pulling images within the same Region has no data transfer charge.
- Free tier: Negligible.
No lifecycle policy, so old images pile up forever; pulling images through a NAT Gateway instead of a VPC endpoint.
When ECS can't pull an image from ECR, the usual cause is missing permissions on the task execution role. To copy images to other regions or accounts automatically → enable ECR replication.
Frequently asked questions
How is ECR different from Docker Hub?
ECR is a private image registry in your AWS account, secured with IAM and integrated with ECS, EKS and Lambda; pulling images within the same region is fast and does not go over the internet. Docker Hub is a public, external registry with pull rate limits.
Does ECR scan images for vulnerabilities?
Yes. Basic scanning runs when an image is pushed or on demand. Enhanced scanning uses Amazon Inspector to scan continuously, covering both operating system packages and programming language libraries.
How is ECR priced?
By the amount of image data stored per month and the data transferred out. Set a lifecycle policy to delete old images automatically so storage costs don't keep growing.
What do AWS exams ask about ECR?
The permissions ECS needs to pull images (execution role), lifecycle policies to remove old images, replicating images to other regions or accounts, and vulnerability scanning.