Skip to main content
Amazon Elastic Container Registry (ECR) is a fully managed container image registry service from AWS. ECR simplifies storing, managing, and deploying Docker images, and integrates tightly with AWS compute services such as Amazon ECS, Amazon EKS, and AWS Fargate. Typical ECR workflows include building images from a Dockerfile, pushing them to ECR, and having your orchestrator pull and run those images.
  • Write a Dockerfile that defines how to build your container image.
  • Build the Docker image locally or in CI.
  • Push the image to a container registry such as Amazon ECR.
  • Have your container orchestrator (ECS, EKS, Fargate, or an on-prem runtime) pull the image and run containers from it.
Once an image is uploaded to ECR, platforms or tools that have access — either by public access (for public repositories) or by authenticating via IAM (for private repositories) — can pull that image and deploy it.
A diagram showing Amazon ECR on the left with arrows to Amazon ECS, Amazon EKS, and an On Premise environment on the right. It illustrates ECR distributing container images to those deployment targets.

​
Repository types: Public vs Private

ECR supports two repository types: Public and Private. Choose based on distribution needs, security, and cost considerations.
A simple diagram of AWS ECR showing Public and Private repositories holding container images, with a developer pushing images on the left and cloud/public or corporate/users accessing them on the right. Arrows show the flow between the developer, the ECR icons and the cloud/enterprise consumers.
Public ECR repositories are visible to anyone on the internet for pulls. Do not store secrets or private artifacts in public repositories.

​
Integrating ECR with CI/CD

A common CI/CD flow for containerized applications using ECR:
  1. Developer pushes code to a source repository (e.g., CodeCommit, GitHub).
  2. A pipeline (e.g., CodePipeline) triggers a build (e.g., CodeBuild).
  3. The build process produces a Docker image.
  4. The build authenticates to ECR and pushes the image to a repository.
  5. A deployment step pulls the image from ECR and deploys it to ECS, EKS, or Fargate.
This setup centralizes image build, storage, and deployment within AWS, making it easy to automate release pipelines and maintain artifact provenance.

​
Common ECR permissions

Ensure the IAM roles or users used by your CI/CD system and compute services have the right ECR permissions. Key permissions include:

​
Authenticate, tag, and push — example (AWS CLI v2 + Docker)

Use AWS CLI v2’s get-login-password to authenticate Docker to ECR, then tag and push your image.
Ensure you use AWS CLI v2 (or another supported method) for get-login-password (see https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login-password.html). In CI environments (e.g., CodeBuild), attach an IAM role with the appropriate ECR permissions instead of embedding long-lived AWS credentials.

​
Key ECR features & operational details

  • Fully managed: AWS operates the registry service, handling storage scaling and high availability.
  • Integrations: Works with ECS, EKS, Fargate, Lambda, and other AWS services for deployment workflows.
  • Repository types: Public repositories for broad distribution; private repositories for restricted access.
  • Lifecycle policies: Define rules to automatically expire old, untagged, or unused images to control storage costs.
  • Image scanning: Built-in scanning (Amazon Inspector integration) detects known vulnerabilities (CVEs) in images.
  • Image immutability and tags: Optionally enable tag immutability to prevent accidental overwrites; use image digests for immutable references.
  • Layers and storage: Images are stored as layers; shared layers across images reduce storage usage.
A presentation slide titled "Features" showing five numbered cards with colorful circular icons labeled: 01 Fully Managed, 02 Integration With AWS Services, 03 Private Registry, 04 Image Lifecycle Management, and 05 Image Scanning. Each card contains a gradient icon above a short descriptive label.
ECR provides a secure, scalable registry service that fits naturally into AWS-based CI/CD pipelines. By centralizing container images in ECR, you can enforce access control with IAM, automate lifecycle management and scanning, and streamline deployments to AWS orchestrators.

Watch Video