Amazon Elastic Container Registry

Amazon Elastic Container Registry (Amazon ECR) is a fully managed Docker container registry service hosted on Amazon Web Services (AWS). It provides a secure, scalable, and highly available registry for storing, managing, and deploying container images, integrated with the broader AWS ecosystem including Amazon ECS, Amazon EKS, and AWS IAM.

Overview

Amazon ECR is AWS’s managed container registry offering, designed for teams building and deploying containerized applications on AWS. ECR eliminates the need to operate your own container registry infrastructure — AWS handles scaling, patching, and availability. It integrates natively with Amazon Elastic Container Service (ECS) and Amazon Elastic Kubernetes Service (EKS) for seamless image pulls during deployments.

ECR is a cloud-only service with no self-hosted version. It is designed for organizations already using AWS who want a managed, low-maintenance container registry with deep integration into the AWS ecosystem.

Key Features

  • Fully managed: No infrastructure to manage — AWS handles scaling, patching, and availability
  • Docker and OCI support: Standard Docker Registry HTTP API V2 and OCI image format support
  • Image scanning: Built-in basic scanning using Common Vulnerabilities and Exposures (CVE) database. Enhanced scanning available via Amazon Inspector integration
  • Lifecycle policies: Automatically clean up unused images based on age, count, or tag rules to control storage costs
  • Image signing: Support for Docker Content Trust and Notary for image authenticity verification
  • IAM integration: Fine-grained access control using AWS Identity and Access Management policies
  • Cross-region replication: Replicate images across AWS regions for low-latency deployments
  • Cross-account sharing: Share images across AWS accounts for multi-team or multi-organization workflows
  • Private endpoints: VPC endpoints for private connectivity without traversing the public internet
  • Tag immutability: Prevent overwriting of tagged images for supply chain security
  • Registry policies: Fine-grained control over repository access and image push/pull operations
  • Web console: Browse and manage images through the AWS Management Console
  • High availability: Data is redundantly stored across multiple Availability Zones

Technical Stack

  • Service type: Fully managed PaaS on Amazon Web Services
  • API: Docker Registry HTTP API V2, OCI Distribution Specification
  • Authentication: AWS IAM, AWS Identity Center (formerly SSO)
  • Storage: AWS-managed storage (backed by S3)
  • Deployment: Cloud-only — no self-hosted option
  • CLI: AWS CLI (aws ecr commands), Docker CLI

Licensing

Amazon ECR is a commercial, proprietary cloud service from Amazon Web Services. There is no open-source edition and no self-hosted version. ECR is billed based on storage used and data transfer. It is a pay-as-you-go service with no upfront costs.

Pricing

Component Cost (approx.) Notes
Storage $0.10 per GB per month Charged per GB of data stored in repositories
Data transfer (inbound) Free Pushing images to ECR from the internet is free
Data transfer (outbound) $0.09/GB (first 10 TB/month) Pulling images to the internet. Free within same region to ECS/EKS.
Enhanced scanning (Inspector) $0.15 per image scan Per image scanned by Amazon Inspector

Pricing based on AWS public pricing (US East region) as of June 2026. Actual costs vary by region. Check the AWS pricing page for current rates.

Self-Hosting

No. Amazon ECR is a cloud-only managed service. It cannot be self-hosted or deployed on-premises. Organizations requiring an on-premises container registry should consider Harbor, Sonatype Nexus, or JFrog Artifactory instead.

Official Resources