Skip to main content

Amazon Elastic Container Registry

Amazon Elastic Container Registry features

Page topics

Amazon container orchestrator integration

Open all

Amazon Elastic Container Registry (Amazon ECR) is integrated with Amazon Elastic Container Service (Amazon ECS) and Amazon Elastic Kubernetes Service (Amazon EKS), which means you can easily store and run container images for applications with either orchestrator. All you need to do is specify the Amazon ECR repository in your task or pod definition for Amazon ECS or Amazon EKS to retrieve the appropriate images for your applications.

OCI and Docker support

Open all

Amazon ECR supports  Open Container Initiative  (OCI) standards and the Docker Registry HTTP API V2. This allows you to use Docker CLI commands (e.g., push, pull, list, tag) or your preferred Docker tools to interact with Amazon ECR, maintaining your existing development workflow. You can easily access Amazon ECR from any Docker environment, whether in the cloud, on-premises, or on your local machine. Amazon ECR lets you store Docker container images and related OCI artifacts in your repositories.

AWS Marketplace

Open all

Amazon ECR stores both the containers you create and any container software you buy through AWS Marketplace.  AWS Marketplace for Containers  offers verified container software for high performance computing, security, and developer tools, as well as software as a service (SaaS) products that manage, analyze, and protect container applications.

High availability and durability

Open all

Amazon ECR stores your container images and artifacts in Amazon Simple Storage Service (S3). Amazon S3 is designed for 99.999999999% (11 9’s) of data durability because it automatically creates and stores copies of all S3 objects across multiple systems. This means that your data is available when needed and protected against failures, errors, and threats. Amazon ECR can also automatically replicate your data to multiple AWS Regions for your high availability applications.

Team and public collaboration

Open all

Amazon ECR supports the ability to define and organize repositories in your registry using namespaces. This allows you to organize your repositories based on your team’s existing workflows. You can set which API actions another user may perform on your repository (e.g., create, list, describe, delete, and get) through resource-level policies, allowing you to share your repositories easily with different users and AWS accounts. You can easily share your container artifacts with anyone in the world by storing them in a public repository.

Access control

Open all

Amazon ECR uses AWS Identity and Access Management (IAM) to control and monitor who and what (e.g., EC2 instances) can access your container images. Through IAM, you can define policies to allow users within the same AWS account or other accounts to access your container images in private repositories. You can also further refine these policies by specifying different permissions for different users and roles (e.g., push, pull, or full administrator access). Anyone in the world can access your container images stored in public repositories for worldwide collaboration.

Encryption

Open all

You can transfer your container images to and from Amazon ECR via HTTPS. Your images are also automatically encrypted at rest using Amazon S3 server-side encryption. Amazon ECR also lets you choose your own key managed by AWS Key Management Service (AWS KMS) to encrypt images at rest.

Third-party integrations

Open all

Amazon ECR is integrated with third-party developer tools. You can integrate Amazon ECR into your continuous integration and delivery process, allowing you to maintain your existing development workflow. Learn more about our third-party integration on our  Partners  page.

Pull through cache repositories

Open all

With Amazon ECR’s pull through cache repositories, you can retrieve, store, and sync container artifacts stored in publicly accessible container registries. They offer the high download rates that you need and the availability, security, and scale that you’ve come to depend on. With frequent registry syncs and no additional tools to manage, pull through cache repositories help you keep container images sourced from public registries up to date.

Image signing and trust verification

Open all

Amazon ECR now supports managed container image signing to enhance your security posture and eliminate the process of setting up signing. Container image signing allows you to verify that images are from trusted sources. With managed signing, ECR simplifies setting up container image signing to just a few clicks in the ECR Console or a single API call. To enable managed signing, you create a signing rule with a signing profile, which is a unique AWS resource that allows you to specify parameters such as signature validity and which IAM principals can sign. You then specify which repositories you would like ECR to sign images in, which can be all of the repositories in the registry or a subset of your repositories using repository names as filters. Once configured, ECR will automatically sign new images as they are pushed to the specified repositories using the credentials of the IAM principal that pushed the image. Get started here.