ECR for container image registry in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

ECR Image Pull Behavior

You have an Amazon ECR repository with an image tagged as latest. If you pull the image using the latest tag multiple times without pushing a new image, what will happen?

A Each pull downloads the image again, increasing data transfer costs.

B ECR automatically updates the image tag to a new version on each pull.

C Pulling the image with the same tag multiple times causes the image to be deleted from the repository.

D The image is cached locally after the first pull, so subsequent pulls use the cached image unless forced to refresh.

💡 Hint

Think about how Docker clients handle image tags and caching.

Docker clients cache images locally after the first pull. Pulling the same tag again uses the cached image unless you explicitly force a refresh. This behavior reduces data transfer and speeds up deployments.

❓ security

intermediate

ECR Repository Access Control

You want to restrict access to an ECR repository so that only a specific IAM user can push images, but multiple users can pull images. Which IAM policy setup achieves this?

A Attach a policy denying all actions to all users except the specific user.

B Attach a policy allowing <code>ecr:PutImage</code> to all users and <code>ecr:GetDownloadUrlForLayer</code> only to the specific user.

C Attach a policy to the repository allowing <code>ecr:BatchCheckLayerAvailability</code> and <code>ecr:GetDownloadUrlForLayer</code> to all users, and <code>ecr:PutImage</code> only to the specific user.

D Attach a policy allowing <code>ecr:* </code> to all users.

💡 Hint

Consider which actions are needed for pushing versus pulling images.

Pushing images requires ecr:PutImage permission, while pulling requires read permissions like ecr:BatchCheckLayerAvailability and ecr:GetDownloadUrlForLayer. Restricting PutImage to one user and allowing read actions to others enforces the desired access control.

❓ Architecture

advanced

ECR Cross-Region Replication Setup

You want to replicate container images automatically from an ECR repository in us-east-1 to another repository in eu-west-1. Which configuration is required to enable this cross-region replication?

A Enable cross-region replication in the source repository and specify the destination region and repository ARN. Ensure the replication role has permissions in both regions.

B Manually push images to the destination repository after pulling from the source repository.

C Create a Lambda function that copies images between regions on a schedule.

D Enable versioning on the source repository to automatically replicate images.

💡 Hint

Think about built-in ECR features for replication.

ECR supports cross-region replication by enabling it on the source repository and specifying destination repositories. A replication IAM role with permissions in both regions is required to allow ECR to replicate images automatically.

✅ Best Practice

advanced

ECR Image Tagging Strategy

Which image tagging strategy helps avoid overwriting important images and supports easy rollback in ECR?

A Use random tags generated at push time without versioning.

B Use immutable tags and include version numbers or commit hashes in tags.

C Always use the <code>latest</code> tag and overwrite it with each new image push.

D Delete old images immediately after pushing new ones to save space.

💡 Hint

Consider how to keep track of image versions safely.

Using immutable tags with version numbers or commit hashes prevents accidental overwrites and allows you to roll back to previous versions easily. Overwriting latest can cause confusion and deployment issues.

🧠 Conceptual

expert

ECR Lifecycle Policy Behavior

An ECR lifecycle policy is configured to expire untagged images older than 30 days and images tagged with dev older than 7 days. After 40 days, which images will be deleted?

A All untagged images older than 30 days and all images tagged <code>dev</code> older than 7 days will be deleted.

B Only images tagged <code>dev</code> older than 7 days will be deleted; untagged images are kept indefinitely.

C Only untagged images older than 30 days will be deleted; tagged images are never deleted.

D No images will be deleted because lifecycle policies do not apply automatically.

💡 Hint

Think about how lifecycle policies apply to different tag filters and image ages.

ECR lifecycle policies apply rules independently. Untagged images older than 30 days and images tagged dev older than 7 days both match their respective rules and will be deleted after 40 days.

Practice

1. What is the primary purpose of AWS Elastic Container Registry (ECR)?

easy

A. To store and manage container images securely

B. To run containerized applications

C. To monitor AWS cloud resources

D. To provide virtual machines for deployment

Solution

1. Step 1: Understand ECR's role

   AWS ECR is designed to store container images safely and manage them.

2. Step 2: Differentiate from other services

   Running containers is done by ECS or EKS, not ECR. Monitoring and VMs are unrelated.

3. Final Answer:

   To store and manage container images securely -> Option A

4. Quick Check:

   ECR = Container image storage [OK]

Hint: ECR stores images, ECS/EKS run containers [OK]

Common Mistakes:

• Confusing ECR with ECS or EKS
• Thinking ECR runs containers
• Assuming ECR monitors resources

2. Which AWS CLI command correctly creates a new ECR repository named my-app?

easy

A. aws ecr make-repo --repository my-app

B. aws ecr new-repository --name my-app

C. aws ecr create-repository --repository-name my-app

D. aws ecr init-repository --repo my-app

Solution

1. Step 1: Recall AWS CLI syntax for ECR

   The correct command to create a repository is aws ecr create-repository --repository-name <name>.

2. Step 2: Check options for correctness

   Options B, C, and D use invalid commands or flags not recognized by AWS CLI.

3. Final Answer:

   aws ecr create-repository --repository-name my-app -> Option C

4. Quick Check:

   Create repo command = aws ecr create-repository --repository-name my-app [OK]

Hint: Use 'create-repository' with '--repository-name' flag [OK]

Common Mistakes:

• Using incorrect command verbs like 'new' or 'make'
• Wrong flag names like '--name' or '--repo'
• Assuming 'init-repository' is valid

3. Given this AWS CLI command output snippet after pushing an image to ECR, what does the imageScanStatus value IN_PROGRESS indicate?

{
  "imageId": {"imageTag": "v1"},
  "imageScanStatus": {"status": "IN_PROGRESS"}
}

medium

A. The image scan for vulnerabilities is currently running

B. The image scan has completed with no issues

C. The image push failed due to scan errors

D. The image is not scanned because scanning is disabled

Solution

1. Step 1: Understand imageScanStatus meaning

   The status IN_PROGRESS means the scan is currently running on the image.

2. Step 2: Eliminate other options

   Completed scans show COMPLETE, failures show FAILED, and disabled scanning shows no status.

3. Final Answer:

   The image scan for vulnerabilities is currently running -> Option A

4. Quick Check:

   IN_PROGRESS = scan running [OK]

Hint: IN_PROGRESS means scan is running, not done [OK]

Common Mistakes:

• Assuming IN_PROGRESS means scan passed
• Confusing scan failure with in-progress status
• Thinking scanning is disabled

4. You tried to push a container image to ECR but got an error: denied: Your authorization token has expired. What is the most likely fix?

medium

A. Restart the AWS CLI tool

B. Delete the repository and create a new one

C. Change the image tag and push again

D. Run aws ecr get-login-password again to refresh credentials

Solution

1. Step 1: Identify cause of authorization token error

   ECR login tokens expire after 12 hours, so pushing images requires fresh tokens.

2. Step 2: Refresh credentials properly

   Running aws ecr get-login-password and logging in again refreshes the token.

3. Final Answer:

   Run aws ecr get-login-password again to refresh credentials -> Option D

4. Quick Check:

   Expired token fix = refresh login [OK]

Hint: Refresh ECR login token before pushing images [OK]

Common Mistakes:

• Deleting repository unnecessarily
• Changing image tag won't fix auth
• Restarting CLI doesn't refresh token

5. You want to ensure that only images with specific tags can be overwritten in your ECR repository. Which ECR feature helps enforce this?

hard

A. VPC endpoints

B. Image tag immutability

C. Lifecycle policies

D. Cross-region replication

Solution

1. Step 1: Understand tag immutability

   Image tag immutability prevents overwriting images with the same tag, protecting specific versions.

2. Step 2: Differentiate from other features

   Lifecycle policies manage image cleanup, VPC endpoints control network access, replication copies images across regions.

3. Final Answer:

   Image tag immutability -> Option B

4. Quick Check:

   Prevent tag overwrite = immutability [OK]

Hint: Use tag immutability to block overwrites [OK]

Common Mistakes:

• Confusing lifecycle policies with immutability
• Thinking VPC endpoints control tags
• Assuming replication affects tag overwrite