ECR for container image registry in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Amazon ECR?

Amazon Elastic Container Registry (ECR) is a fully managed container image registry service that makes it easy to store, manage, and deploy Docker container images securely.

intermediate

How does Amazon ECR help with container image security?

Amazon ECR integrates with AWS Identity and Access Management (IAM) to control who can access your container images. It also supports image scanning to detect vulnerabilities in your container images.

intermediate

What is the benefit of using a managed container registry like ECR compared to a self-hosted registry?

Using ECR removes the need to manage infrastructure for storing container images. It provides high availability, scalability, and integrates with other AWS services, reducing operational overhead.

beginner

What is a repository in Amazon ECR?

A repository in Amazon ECR is a collection where container images are stored and organized. Each repository can hold multiple versions of container images identified by tags.

intermediate

How do you authenticate Docker to push or pull images from Amazon ECR?

You authenticate Docker to Amazon ECR by retrieving an authentication token using the AWS CLI and then using it to log in to the ECR registry. This token is temporary and must be refreshed regularly.

What does Amazon ECR primarily store?

A Server logs

B Virtual machines

C Database backups

D Container images

Amazon ECR is designed to store container images used for deploying containers.

Which AWS service controls access permissions for ECR repositories?

A AWS CloudTrail

B AWS Lambda

C AWS IAM

D AWS S3

AWS Identity and Access Management (IAM) manages permissions for accessing ECR repositories.

What is required before pushing a Docker image to ECR?

A Authenticate Docker with ECR using a token

B Create an EC2 instance

C Enable CloudWatch logging

D Set up a VPC

Docker must be authenticated with ECR using a temporary token before pushing images.

Which feature helps identify security issues in container images stored in ECR?

A Image scanning

B Auto scaling

C Load balancing

D CloudFormation

Image scanning detects vulnerabilities in container images stored in ECR.

What is a repository in Amazon ECR?

A A database instance

B A storage location for container images

C A compute resource

D A network gateway

A repository is where container images are stored and organized in ECR.

Explain how Amazon ECR integrates with Docker to manage container images.

Think about how Docker clients connect securely to ECR and how images are stored.

Describe the security features provided by Amazon ECR for container image management.

Consider both access control and image protection mechanisms.

Practice

1. What is the primary purpose of AWS Elastic Container Registry (ECR)?

easy

A. To store and manage container images securely

B. To run containerized applications

C. To monitor AWS cloud resources

D. To provide virtual machines for deployment

Solution

1. Step 1: Understand ECR's role

   AWS ECR is designed to store container images safely and manage them.

2. Step 2: Differentiate from other services

   Running containers is done by ECS or EKS, not ECR. Monitoring and VMs are unrelated.

3. Final Answer:

   To store and manage container images securely -> Option A

4. Quick Check:

   ECR = Container image storage [OK]

Hint: ECR stores images, ECS/EKS run containers [OK]

Common Mistakes:

• Confusing ECR with ECS or EKS
• Thinking ECR runs containers
• Assuming ECR monitors resources

2. Which AWS CLI command correctly creates a new ECR repository named my-app?

easy

A. aws ecr make-repo --repository my-app

B. aws ecr new-repository --name my-app

C. aws ecr create-repository --repository-name my-app

D. aws ecr init-repository --repo my-app

Solution

1. Step 1: Recall AWS CLI syntax for ECR

   The correct command to create a repository is aws ecr create-repository --repository-name <name>.

2. Step 2: Check options for correctness

   Options B, C, and D use invalid commands or flags not recognized by AWS CLI.

3. Final Answer:

   aws ecr create-repository --repository-name my-app -> Option C

4. Quick Check:

   Create repo command = aws ecr create-repository --repository-name my-app [OK]

Hint: Use 'create-repository' with '--repository-name' flag [OK]

Common Mistakes:

• Using incorrect command verbs like 'new' or 'make'
• Wrong flag names like '--name' or '--repo'
• Assuming 'init-repository' is valid

3. Given this AWS CLI command output snippet after pushing an image to ECR, what does the imageScanStatus value IN_PROGRESS indicate?

{
  "imageId": {"imageTag": "v1"},
  "imageScanStatus": {"status": "IN_PROGRESS"}
}

medium

A. The image scan for vulnerabilities is currently running

B. The image scan has completed with no issues

C. The image push failed due to scan errors

D. The image is not scanned because scanning is disabled

Solution

1. Step 1: Understand imageScanStatus meaning

   The status IN_PROGRESS means the scan is currently running on the image.

2. Step 2: Eliminate other options

   Completed scans show COMPLETE, failures show FAILED, and disabled scanning shows no status.

3. Final Answer:

   The image scan for vulnerabilities is currently running -> Option A

4. Quick Check:

   IN_PROGRESS = scan running [OK]

Hint: IN_PROGRESS means scan is running, not done [OK]

Common Mistakes:

• Assuming IN_PROGRESS means scan passed
• Confusing scan failure with in-progress status
• Thinking scanning is disabled

4. You tried to push a container image to ECR but got an error: denied: Your authorization token has expired. What is the most likely fix?

medium

A. Restart the AWS CLI tool

B. Delete the repository and create a new one

C. Change the image tag and push again

D. Run aws ecr get-login-password again to refresh credentials

Solution

1. Step 1: Identify cause of authorization token error

   ECR login tokens expire after 12 hours, so pushing images requires fresh tokens.

2. Step 2: Refresh credentials properly

   Running aws ecr get-login-password and logging in again refreshes the token.

3. Final Answer:

   Run aws ecr get-login-password again to refresh credentials -> Option D

4. Quick Check:

   Expired token fix = refresh login [OK]

Hint: Refresh ECR login token before pushing images [OK]

Common Mistakes:

• Deleting repository unnecessarily
• Changing image tag won't fix auth
• Restarting CLI doesn't refresh token

5. You want to ensure that only images with specific tags can be overwritten in your ECR repository. Which ECR feature helps enforce this?

hard

A. VPC endpoints

B. Image tag immutability

C. Lifecycle policies

D. Cross-region replication

Solution

1. Step 1: Understand tag immutability

   Image tag immutability prevents overwriting images with the same tag, protecting specific versions.

2. Step 2: Differentiate from other features

   Lifecycle policies manage image cleanup, VPC endpoints control network access, replication copies images across regions.

3. Final Answer:

   Image tag immutability -> Option B

4. Quick Check:

   Prevent tag overwrite = immutability [OK]

Hint: Use tag immutability to block overwrites [OK]

Common Mistakes:

• Confusing lifecycle policies with immutability
• Thinking VPC endpoints control tags
• Assuming replication affects tag overwrite