ECR for container image registry in AWS - Mini Project: Build & Apply

ECR for container image registry

📖 Scenario: You are working on a cloud project where you need a place to store your container images securely. AWS Elastic Container Registry (ECR) is a service that lets you store and manage Docker container images easily.Think of ECR as a private photo album but for your container images. You want to create this album, set some rules, and then upload your images to it.

🎯 Goal: Create an AWS ECR repository named my-app-repo to store container images. Configure it with basic settings to keep your images safe and ready for deployment.

📋 What You'll Learn

Create an ECR repository named my-app-repo

Set the repository to have image scanning on push enabled

Configure the repository to have a lifecycle policy to keep only the last 5 images

Add a tag to the repository with key Environment and value Development

💡 Why This Matters

🌍 Real World

ECR is widely used to store container images securely in AWS environments, enabling smooth deployment pipelines.

💼 Career

Knowing how to configure ECR repositories is essential for cloud engineers and DevOps professionals managing containerized applications.

1

Create the ECR repository resource

Write the AWS CloudFormation resource code to create an ECR repository named my-app-repo. Use the resource type AWS::ECR::Repository and set the RepositoryName property exactly to my-app-repo.

AWS

# Write the AWS::ECR::Repository resource with RepositoryName 'my-app-repo'
# Your code here

Hint

Use the Resources section and define a resource with Type as AWS::ECR::Repository. Set RepositoryName to my-app-repo.

2

Enable image scanning on push

Add the property ImageScanningConfiguration to the my-app-repo repository resource. Set ScanOnPush to true to enable automatic scanning of images when they are pushed.

AWS

Resources:
  MyAppRepo:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: my-app-repo
      # Add ImageScanningConfiguration with ScanOnPush true below
      # Your code here

Hint

Inside Properties, add ImageScanningConfiguration with ScanOnPush set to true.

3

Add lifecycle policy to keep last 5 images

Add the property LifecyclePolicy to the my-app-repo resource. Set LifecyclePolicyText to a JSON string that keeps only the last 5 images by tag count. Use the rule type expire with tagStatus set to any and countType set to tagCount with countNumber 5.

AWS

Resources:
  MyAppRepo:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: my-app-repo
      ImageScanningConfiguration:
        ScanOnPush: true
      # Add LifecyclePolicy with rule to keep last 5 images
      # Your code here

Hint

Use LifecyclePolicy with LifecyclePolicyText as a JSON string defining a rule to expire images keeping only the last 5.

4

Add a tag to the repository

Add the Tags property to the my-app-repo resource. Add a tag with Key set to Environment and Value set to Development.

AWS

Resources:
  MyAppRepo:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: my-app-repo
      ImageScanningConfiguration:
        ScanOnPush: true
      LifecyclePolicy:
        LifecyclePolicyText: |
          {
            "rules": [
              {
                "rulePriority": 1,
                "description": "Keep last 5 images",
                "selection": {
                  "tagStatus": "any",
                  "countType": "tagCount",
                  "countNumber": 5
                },
                "action": {
                  "type": "expire"
                }
              }
            ]
          }
      # Add Tags property with Environment: Development
      # Your code here

Hint

Add the Tags property as a list with one tag having Key and Value as specified.

Practice

1. What is the primary purpose of AWS Elastic Container Registry (ECR)?

easy

A. To store and manage container images securely

B. To run containerized applications

C. To monitor AWS cloud resources

D. To provide virtual machines for deployment

Solution

1. Step 1: Understand ECR's role

   AWS ECR is designed to store container images safely and manage them.

2. Step 2: Differentiate from other services

   Running containers is done by ECS or EKS, not ECR. Monitoring and VMs are unrelated.

3. Final Answer:

   To store and manage container images securely -> Option A

4. Quick Check:

   ECR = Container image storage [OK]

Hint: ECR stores images, ECS/EKS run containers [OK]

Common Mistakes:

• Confusing ECR with ECS or EKS
• Thinking ECR runs containers
• Assuming ECR monitors resources

2. Which AWS CLI command correctly creates a new ECR repository named my-app?

easy

A. aws ecr make-repo --repository my-app

B. aws ecr new-repository --name my-app

C. aws ecr create-repository --repository-name my-app

D. aws ecr init-repository --repo my-app

Solution

1. Step 1: Recall AWS CLI syntax for ECR

   The correct command to create a repository is aws ecr create-repository --repository-name <name>.

2. Step 2: Check options for correctness

   Options B, C, and D use invalid commands or flags not recognized by AWS CLI.

3. Final Answer:

   aws ecr create-repository --repository-name my-app -> Option C

4. Quick Check:

   Create repo command = aws ecr create-repository --repository-name my-app [OK]

Hint: Use 'create-repository' with '--repository-name' flag [OK]

Common Mistakes:

• Using incorrect command verbs like 'new' or 'make'
• Wrong flag names like '--name' or '--repo'
• Assuming 'init-repository' is valid

3. Given this AWS CLI command output snippet after pushing an image to ECR, what does the imageScanStatus value IN_PROGRESS indicate?

{
  "imageId": {"imageTag": "v1"},
  "imageScanStatus": {"status": "IN_PROGRESS"}
}

medium

A. The image scan for vulnerabilities is currently running

B. The image scan has completed with no issues

C. The image push failed due to scan errors

D. The image is not scanned because scanning is disabled

Solution

1. Step 1: Understand imageScanStatus meaning

   The status IN_PROGRESS means the scan is currently running on the image.

2. Step 2: Eliminate other options

   Completed scans show COMPLETE, failures show FAILED, and disabled scanning shows no status.

3. Final Answer:

   The image scan for vulnerabilities is currently running -> Option A

4. Quick Check:

   IN_PROGRESS = scan running [OK]

Hint: IN_PROGRESS means scan is running, not done [OK]

Common Mistakes:

• Assuming IN_PROGRESS means scan passed
• Confusing scan failure with in-progress status
• Thinking scanning is disabled

4. You tried to push a container image to ECR but got an error: denied: Your authorization token has expired. What is the most likely fix?

medium

A. Restart the AWS CLI tool

B. Delete the repository and create a new one

C. Change the image tag and push again

D. Run aws ecr get-login-password again to refresh credentials

Solution

1. Step 1: Identify cause of authorization token error

   ECR login tokens expire after 12 hours, so pushing images requires fresh tokens.

2. Step 2: Refresh credentials properly

   Running aws ecr get-login-password and logging in again refreshes the token.

3. Final Answer:

   Run aws ecr get-login-password again to refresh credentials -> Option D

4. Quick Check:

   Expired token fix = refresh login [OK]

Hint: Refresh ECR login token before pushing images [OK]

Common Mistakes:

• Deleting repository unnecessarily
• Changing image tag won't fix auth
• Restarting CLI doesn't refresh token

5. You want to ensure that only images with specific tags can be overwritten in your ECR repository. Which ECR feature helps enforce this?

hard

A. VPC endpoints

B. Image tag immutability

C. Lifecycle policies

D. Cross-region replication

Solution

1. Step 1: Understand tag immutability

   Image tag immutability prevents overwriting images with the same tag, protecting specific versions.

2. Step 2: Differentiate from other features

   Lifecycle policies manage image cleanup, VPC endpoints control network access, replication copies images across regions.

3. Final Answer:

   Image tag immutability -> Option B

4. Quick Check:

   Prevent tag overwrite = immutability [OK]

Hint: Use tag immutability to block overwrites [OK]

Common Mistakes:

• Confusing lifecycle policies with immutability
• Thinking VPC endpoints control tags
• Assuming replication affects tag overwrite