Amazon ECR: Building, Pushing & Scanning Images
~10 min read
How ECR fits into the container pipeline as the registry ECS and EKS both pull from.
Amazon ECR (Elastic Container Registry) is AWS's managed Docker image registry — private by default, integrated with IAM for push/pull permissions, and used as the image source for both ECS and EKS task/pod definitions. A typical CI pipeline authenticates to ECR, builds the image, tags it (commonly with both a semantic version and the Git commit SHA for traceability), and pushes it; ECS or EKS then references that exact tag in a task definition or pod spec. ECR supports image scanning (checking for known CVEs in the image's OS packages and dependencies) either on push or on a schedule, and lifecycle policies to automatically expire old, untagged images so the repository doesn't grow unbounded.
💻 Code example
aws ecr get-login-password | docker login --username AWS --password-stdin <account>.dkr.ecr.<region>.amazonaws.com
docker build -t myapp:1.2.0 .
docker tag myapp:1.2.0 <account>.dkr.ecr.<region>.amazonaws.com/myapp:1.2.0
docker push <account>.dkr.ecr.<region>.amazonaws.com/myapp:1.2.0
💬 Deep Dive with AI
Key points
- •ECR is private-by-default and IAM-integrated for push/pull access control
- •Tag images with both a semantic version and Git SHA for traceability back to source
- •Enable image scanning to catch known CVEs before a vulnerable image reaches production
- •Use lifecycle policies to auto-expire old untagged images and control storage cost