Bird
Raised Fist0
AWScloud~5 mins

ECR for container image registry in AWS - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Introduction
Storing container images safely is important so you can use them anytime. Amazon Elastic Container Registry (ECR) is a service that keeps your container images in one place, making it easy to manage and use them with your apps.
When you want to store your app's container images close to your AWS services for faster deployment.
When you need a secure place to keep container images with controlled access.
When you want to share container images easily between your team members or AWS accounts.
When you want to automate container image storage as part of your build and deploy process.
When you want to avoid managing your own container registry infrastructure.
Config File - repository-policy.json
repository-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPushPull",
      "Effect": "Allow",
      "Principal": {"AWS": "*"},
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ]
    }
  ]
}

This JSON file defines a policy for the ECR repository.

Version: The policy language version.

Statement: The rules for who can do what.

Effect: Allows the actions listed.

Principal: "*" means anyone with AWS credentials can push and pull images.

Action: Lists the permissions needed to upload and download container images.

Commands
This command creates a new container image repository named 'my-app-repo' in the US East (N. Virginia) region.
Terminal
aws ecr create-repository --repository-name my-app-repo --region us-east-1
Expected OutputExpected
{ "repository": { "repositoryArn": "arn:aws:ecr:us-east-1:123456789012:repository/my-app-repo", "registryId": "123456789012", "repositoryName": "my-app-repo", "repositoryUri": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app-repo", "createdAt": "2024-06-01T12:00:00Z", "imageTagMutability": "MUTABLE", "imageScanningConfiguration": { "scanOnPush": false } } }
→
--repository-name - Sets the name of the new ECR repository.
→
--region - Specifies the AWS region where the repository is created.
This command logs your Docker client into the ECR registry using a temporary password, so you can push and pull images securely.
Terminal
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com
Expected OutputExpected
Login Succeeded
→
--region - Specifies the AWS region for the ECR registry.
This command tags your local Docker image 'my-app:latest' with the full ECR repository URI so it can be pushed to ECR.
Terminal
docker tag my-app:latest 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app-repo:latest
Expected OutputExpected
No output (command runs silently)
This command uploads your tagged Docker image to the ECR repository so it can be used by AWS services.
Terminal
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app-repo:latest
Expected OutputExpected
The push refers to repository [123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app-repo] latest: digest: sha256:abcdef1234567890 size: 1234
This command checks the details of the 'my-app-repo' repository to confirm it exists and see its settings.
Terminal
aws ecr describe-repositories --repository-names my-app-repo --region us-east-1
Expected OutputExpected
{ "repositories": [ { "repositoryArn": "arn:aws:ecr:us-east-1:123456789012:repository/my-app-repo", "registryId": "123456789012", "repositoryName": "my-app-repo", "repositoryUri": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app-repo", "createdAt": "2024-06-01T12:00:00Z", "imageTagMutability": "MUTABLE", "imageScanningConfiguration": { "scanOnPush": false } } ] }
→
--repository-names - Filters the output to show only the specified repository.
→
--region - Specifies the AWS region of the repository.
Key Concept

If you remember nothing else from this pattern, remember: ECR stores your container images securely and lets you push and pull them using Docker commands after logging in.

Common Mistakes
Trying to push images without logging into ECR first.
Docker will reject the push because it does not have permission to access the ECR registry.
Always run the AWS login command to authenticate Docker before pushing images.
Using the wrong repository URI when tagging the image.
Docker will push the image to a non-existent or wrong repository, causing errors or confusion.
Use the exact repository URI returned by the create-repository command when tagging images.
Not specifying the AWS region in commands.
Commands may fail or target the wrong region, causing resource not found errors.
Always include the --region flag with the correct AWS region.
Summary
Create an ECR repository to store your container images securely.
Log in to ECR using AWS CLI to allow Docker to push and pull images.
Tag your local Docker image with the ECR repository URI before pushing.
Push the tagged image to ECR so it can be used by AWS services.
Verify the repository details to confirm your setup.

Practice

(1/5)
1. What is the primary purpose of AWS Elastic Container Registry (ECR)?
easy
A. To store and manage container images securely
B. To run containerized applications
C. To monitor AWS cloud resources
D. To provide virtual machines for deployment

Solution

  1. Step 1: Understand ECR's role

    AWS ECR is designed to store container images safely and manage them.

  2. Step 2: Differentiate from other services

    Running containers is done by ECS or EKS, not ECR. Monitoring and VMs are unrelated.

  3. Final Answer:

    To store and manage container images securely -> Option A

  4. Quick Check:

    ECR = Container image storage [OK]
Hint: ECR stores images, ECS/EKS run containers [OK]
Common Mistakes:
  • Confusing ECR with ECS or EKS
  • Thinking ECR runs containers
  • Assuming ECR monitors resources
2. Which AWS CLI command correctly creates a new ECR repository named my-app?
easy
A. aws ecr make-repo --repository my-app
B. aws ecr new-repository --name my-app
C. aws ecr create-repository --repository-name my-app
D. aws ecr init-repository --repo my-app

Solution

  1. Step 1: Recall AWS CLI syntax for ECR

    The correct command to create a repository is aws ecr create-repository --repository-name <name>.

  2. Step 2: Check options for correctness

    Options B, C, and D use invalid commands or flags not recognized by AWS CLI.

  3. Final Answer:

    aws ecr create-repository --repository-name my-app -> Option C

  4. Quick Check:

    Create repo command = aws ecr create-repository --repository-name my-app [OK]
Hint: Use 'create-repository' with '--repository-name' flag [OK]
Common Mistakes:
  • Using incorrect command verbs like 'new' or 'make'
  • Wrong flag names like '--name' or '--repo'
  • Assuming 'init-repository' is valid
3. Given this AWS CLI command output snippet after pushing an image to ECR, what does the imageScanStatus value IN_PROGRESS indicate?
{
  "imageId": {"imageTag": "v1"},
  "imageScanStatus": {"status": "IN_PROGRESS"}
}
medium
A. The image scan for vulnerabilities is currently running
B. The image scan has completed with no issues
C. The image push failed due to scan errors
D. The image is not scanned because scanning is disabled

Solution

  1. Step 1: Understand imageScanStatus meaning

    The status IN_PROGRESS means the scan is currently running on the image.

  2. Step 2: Eliminate other options

    Completed scans show COMPLETE, failures show FAILED, and disabled scanning shows no status.

  3. Final Answer:

    The image scan for vulnerabilities is currently running -> Option A

  4. Quick Check:

    IN_PROGRESS = scan running [OK]
Hint: IN_PROGRESS means scan is running, not done [OK]
Common Mistakes:
  • Assuming IN_PROGRESS means scan passed
  • Confusing scan failure with in-progress status
  • Thinking scanning is disabled
4. You tried to push a container image to ECR but got an error: denied: Your authorization token has expired. What is the most likely fix?
medium
A. Restart the AWS CLI tool
B. Delete the repository and create a new one
C. Change the image tag and push again
D. Run aws ecr get-login-password again to refresh credentials

Solution

  1. Step 1: Identify cause of authorization token error

    ECR login tokens expire after 12 hours, so pushing images requires fresh tokens.

  2. Step 2: Refresh credentials properly

    Running aws ecr get-login-password and logging in again refreshes the token.

  3. Final Answer:

    Run aws ecr get-login-password again to refresh credentials -> Option D

  4. Quick Check:

    Expired token fix = refresh login [OK]
Hint: Refresh ECR login token before pushing images [OK]
Common Mistakes:
  • Deleting repository unnecessarily
  • Changing image tag won't fix auth
  • Restarting CLI doesn't refresh token
5. You want to ensure that only images with specific tags can be overwritten in your ECR repository. Which ECR feature helps enforce this?
hard
A. VPC endpoints
B. Image tag immutability
C. Lifecycle policies
D. Cross-region replication

Solution

  1. Step 1: Understand tag immutability

    Image tag immutability prevents overwriting images with the same tag, protecting specific versions.

  2. Step 2: Differentiate from other features

    Lifecycle policies manage image cleanup, VPC endpoints control network access, replication copies images across regions.

  3. Final Answer:

    Image tag immutability -> Option B

  4. Quick Check:

    Prevent tag overwrite = immutability [OK]
Hint: Use tag immutability to block overwrites [OK]
Common Mistakes:
  • Confusing lifecycle policies with immutability
  • Thinking VPC endpoints control tags
  • Assuming replication affects tag overwrite
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard