Registry Creation

Each AWS account is automatically provided with a private Amazon ECR registry, where you can store container images such as Docker images. This registry serves as a central hub for managing repositories and images.

Repository Management

Within the registry, users can create multiple repositories. These repositories are designed to store versions of container images and can be configured with repository policies to manage access control. Policies are resource-based and use AWS IAM to control who can push, pull, or manage the images in the repository.

Authentication via Authorization Tokens

To interact with an Amazon ECR repository, a user or application (eg : Amazon EC2 instances) must first authenticate. This authentication is achieved using an authorization token provided by ECR, which is linked to AWS Identity and Access Management (IAM). The authorization token is then passed to the Docker CLI (or another compatible client) to authenticate API requests for pushing or pulling images.

Image Pushing and Pulling

Once authenticated:
Push: Users can upload container images to the repository using Docker commands or other container management tools. These images are stored in the repository with tags indicating their version.
Pull: When an application or service (such as Amazon ECS or Amazon EKS) needs a container image, it can request and retrieve the image from the repository using the image name and tag.

Lifecycle Policies

Repositories often accumulate outdated or unused images, so Amazon ECR provides lifecycle policies to help manage storage. Users can define rules to automate the removal of old or unused images, thus saving storage costs and keeping the repository organized. These policies can be tested before applying, ensuring no valuable images are deleted by accident.

Image Scanning

Security is a major concern with container images. Amazon ECR offers image scanning to identify vulnerabilities in images that are pushed to the repository. This scanning can be automatic (triggered upon image push) or manual (triggered by the user). The scan results provide details about any vulnerabilities found, allowing users to update and patch their images accordingly.

Cross-Region and Cross-Account Replication

ECR enables cross-region replication to allow the same image to be available in multiple AWS regions. This is useful for applications deployed across different geographies. Similarly, cross-account replication allows sharing of images between different AWS accounts while maintaining control over access through repository policies.

Pull-Through Cache

Amazon ECR provides a pull-through cache that allows caching of images from an upstream public registry (e.g., Docker Hub). This cache ensures faster retrieval of images and reduced dependency on the availability or performance of the upstream registry. ECR periodically synchronizes cached images with the upstream registry, ensuring that the images are up to date.

Integration with Other AWS Services

Amazon ECS (Elastic Container Service) and Amazon EKS (Elastic Kubernetes Service) can both pull images from ECR repositories as part of their deployment process.
AWS Lambda can also use container images stored in ECR to run containerized workloads.
Amazon EC2 and AWS Fargate instances often use ECR to pull images for deployment.

Summary of the Workflow:

User or Service Authentication: A user or service authenticates to the ECR using an authorization token.
Push/Pull Images: Authorized users push container images to the repository or pull images for their services.
Security Measures: Image scanning checks for vulnerabilities.
Maintenance: Lifecycle policies clean up old images to optimize storage.
Scaling: Cross-region and cross-account replication provide scalability, and pull-through caching helps ensure performance.