Amazon ECR in Production: IAM, Digests, Scanning, Lifecycle Rules, and Replication
How to operate Amazon ECR as a controlled OCI artifact supply point instead of a pile of mutable image tags.
Amazon Elastic Container Registry stores Docker/OCI images and other OCI-compatible artifacts in repositories scoped to an AWS registry. Authentication proves who is calling; IAM and repository policies decide which actions that identity may perform. CI should use a short-lived role through workload federation rather than a long-lived access key.
Tags are labels; digests are identity
An image digest identifies manifest content. A tag such as latest is a mutable pointer and can move between digests, so production manifests should pin an approved digest or an immutable release tag with recorded provenance. Enable tag immutability where replacement would undermine rollback or audit evidence.
Scanning and retention
ECR supports vulnerability scanning, but findings are inputs to a policy—not proof that an image is safe. Define severity thresholds, exception expiry, and rebuild expectations. Lifecycle policies expire or archive matching images; preview a policy before enabling it and retain every artifact still referenced by production, rollback, or an investigation.
Replication and access
Cross-Region and cross-account replication can reduce pull latency and improve recovery options. Repository policies, lifecycle rules, and some settings do not automatically become identical everywhere, so replication needs a configuration audit. Private endpoints reduce public-network dependency for private workloads, while KMS options and default encryption protect data at rest.
Integrations and failure modes
ECS task definitions and EKS pods can pull directly from ECR when execution or node identities have the correct permissions. Common failures come from expired login tokens, wrong region/account endpoints, missing KMS permissions, network paths, or a tag that moved unexpectedly. Log push and policy events, alert on scanning regressions, and periodically prove that disaster-recovery regions can actually pull the required digests.
Sources: Amazon ECR concepts, ECR lifecycle policies, ECR private replication