Amazon ECR

Containers

Fully managed container image registry for storing, sharing, and deploying Docker/OCI images.

Verified against AWS documentation · 2026-08-28

Key facts

  1. 01Private registry by default; ECR Public is a separate gallery for open distribution
  2. 02Auth via IAM — no separate registry credentials to manage; ECS, EKS, Fargate, Lambda, and App Runner pull natively
  3. 03Image scanning: basic (free, on-push) or enhanced via Amazon Inspector (continuous, OS + language packages)
  4. 04Lifecycle policies auto-expire old images; cross-Region and cross-account replication built in; tags can be made immutable

Exam triggers

Phrases and scenarios that point here.

  • "Store container images", "private Docker registry", "managed registry" → ECR
  • Container deployment on ECS/EKS/Fargate → images come from ECR
  • "Scan images for vulnerabilities" → ECR image scanning (enhanced = Inspector)
  • Multi-Region container deployments or DR → ECR cross-Region replication

Not this service

  • Running the containers themselves → ECS, EKS, or Fargate
  • Storing arbitrary files or build artifacts → S3 or CodeArtifact

Use cases

  1. 01The image warehouse behind CI/CD: pipeline builds an image, pushes to ECR, ECS/EKS pulls the exact tagged version — the registry is the handoff point between build and deploy
  2. 02Sharing one set of blessed base images across an organization via cross-account access, so every team builds on the same patched foundation
  3. 03Replicating images to a second Region so DR clusters can pull locally instead of reaching across Regions at deploy time
  4. 04Pull-through cache for Docker Hub or other upstream registries — dodges rate limits and keeps builds working when the upstream is down
  5. 05Enforcing immutable tags so 'v1.4.2' in production can never silently point at a different image than what was tested

How it's charged

  1. 01Storage per GB-month — layers, not whole images, so shared base layers across many images are stored (and billed) once
  2. 02No per-pull or per-push request charges — cost is purely storage plus data transfer
  3. 03Pulls to AWS compute in the same Region (ECS, EKS, Fargate, Lambda, EC2) are free; cross-Region and internet egress bill at standard transfer rates
  4. 04Enhanced scanning bills separately through Amazon Inspector; basic scanning is free
  5. 05The classic bill surprise: pulling images through a NAT Gateway from private subnets adds NAT data-processing fees — VPC endpoints for ECR avoid it

Commonly confused with

Amazon ECSContainersAmazon EKSContainers

References