Containers
Amazon Elastic Container Registry
Amazon ECR is a managed private and public registry for Docker, OCI container images, and related artifacts, with IAM access control and AWS deployment integrations.
Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with Amazon Elastic Container Registry.
Amazon Elastic Container Registry pricing and cost programs
Pricing model: Container registry usage
- On-Demand
- Available
- Reserved Instances or reserved capacity
- Not applicable
- Savings Plans
- Not applicable
- Spot
- Not applicable
Billing dimensions: Image storage · Data transfer · Scanning
Programs and modes: Private repositories · Public repositories · Basic and enhanced scanning
Storage, transfer, and scanning can be billed by different services or feature tiers.
Free Tier: Available — verify current offers
Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.
Official AWS sources reviewed 2026-07-21.
Why implement Amazon Elastic Container Registry?
- Stores container images close to AWS runtimes with IAM authorization, encryption, lifecycle policies, and private network access options.
- Integrates image scanning with AWS-native basic scanning or Amazon Inspector enhanced scanning to surface operating-system and package vulnerabilities.
- Supports cross-account and cross-Region replication, pull-through cache, and repository policies for centralized container distribution.
How to implement Amazon Elastic Container Registry
- Create repositories with encryption, tag mutability, scanning, replication, and repository-policy settings that match the software-delivery model.
- Authenticate the build environment, build and scan an OCI image, assign a version tag, push it, and capture the immutable digest for deployment.
- Grant deployment roles pull-only access, add lifecycle policies for stale artifacts, and route scan findings or registry events into the remediation workflow.
Amazon Elastic Container Registry best practices
- Use immutable release tags or deploy by digest so an existing version cannot silently change underneath a workload.
- Enable registry-level scanning, triage findings before promotion, use least-privilege IAM and repository policies, and prefer short-lived authentication tokens.
- Apply lifecycle policies to unused images, encrypt repositories appropriately, and replicate only where availability, latency, or account boundaries require it.
Amazon Elastic Container Registry use cases and server impact
- Private images for ECS, EKS, and Batch
- Cross-account container distribution
- Scanned and governed software supply chains
Replaces a self-hosted container registry and much of its storage, availability, authentication, and cleanup infrastructure.
Official implementation resources
Commonly paired AWS services
- Amazon Elastic Container Service — Container orchestration
- Amazon Elastic Kubernetes Service — Managed Kubernetes
- AWS Fargate — Serverless containers
- AWS Batch — Batch computing at scale
- AWS CodeBuild — Build & test code
- AWS CodePipeline — CI/CD pipelines
- AWS Identity and Access Management — Identity & access
- Amazon Inspector — Vulnerability management
Architecture patterns using this service
- Run a containerized web application on Amazon ECS and Fargate — Store immutable images in Amazon ECR, deploy tasks with Amazon ECS on AWS Fargate, route HTTP traffic through an Application Load Balancer, and observe the service in CloudWatch.