Updated 22 Oct 2026 • 5 mins read
What Is Amazon ECR? Features, Pricing, and Cost Tips
Amazon ECR is AWS's managed container image registry, integrated with ECS, EKS, Fargate, and IAM, with vulnerability scanning, replication, pull-through caching, and lifecycle policies. This explainer answers what it is and does, gives its 2026 pricing, explains the NAT Gateway charge that image pulls generate, and lists the cost tips that keep it small.
Amazon ECR (Elastic Container Registry) is AWS's managed registry for storing, versioning, and distributing container images: the place your Docker and OCI images live between being built and being pulled by ECS, EKS, Fargate, or Lambda. It is priced on two things, $0.10 per gigabyte-month of images stored and standard AWS data transfer for pulls that leave the region, with pulls to AWS compute in the same region free, and it carries one cost that appears nowhere on the ECR line: the NAT Gateway charge that image pulls from private subnets generate when no VPC endpoint exists.
This explainer answers what ECR is and does, how it differs from ECR Public and from other registries, how it is priced as of October 2026, where the real costs sit, and the five settings that keep an ECR bill small. Rates are from the official ECR pricing page for US East.
The short answer: Amazon ECR is a fully managed container registry on AWS. It stores and versions container images and OCI artifacts in private repositories, authenticates with IAM, integrates natively with ECS, EKS, Fargate, and Lambda, scans images for vulnerabilities (basic scanning free, enhanced scanning through Amazon Inspector per image), replicates images across regions and accounts, caches public images from Docker Hub and other registries through pull-through cache rules, and expires old images with lifecycle policies. ECR Public hosts images for anyone to pull. Pricing: $0.10 per GB-month of private storage, no charge per image, pull, or repository, pulls to EC2, ECS, EKS, and Fargate in the same region free, $0.09 per GB to the internet, about $0.02 per GB cross-region; ECR Public is free up to 50 GB stored and 500 GB a month served to anonymous internet pulls. The cost most teams miss is image pulls from private subnets through a NAT Gateway at $0.045 per GB, which a free-to-cheap VPC endpoint removes.
What ECR Does
ECR is a registry, which means it does four things: stores images, controls who can push and pull them, delivers them to the compute that runs them, and manages their lifecycle. Each has a feature behind it.
| Capability | What it does | Cost implication | |||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Private repositories | Store container images and OCI artifacts (Helm charts, SBOMs, signatures) with immutable tags if enabled | $0.10 per GB-month; grows with every push unless expired | |||||||||||||||||||||||||||||||||||||||||||||||||||
| IAM authentication | Push and pull permissions through IAM policies and repository policies; cross-account access | Free | |||||||||||||||||||||||||||||||||||||||||||||||||||
| Native integration | ECS, EKS, Fargate, Lambda container images, and CodeBuild pull directly | In-region pulls free | |||||||||||||||||||||||||||||||||||||||||||||||||||
| Image scanning | Basic scanning (free, CVE database) or enhanced scanning through Amazon Inspector (continuous, per image) | Enhanced scanning bills per image scanned and re-scanned | |||||||||||||||||||||||||||||||||||||||||||||||||||
| Replication | Automatic copy of images to other regions or accounts | Storage in each destination plus cross-region transfer about $0.02 per GB | |||||||||||||||||||||||||||||||||||||||||||||||||||
| Pull-through cache | Fetches and caches images from Docker Hub, ECR Public, Quay, GitHub, and others on first pull | Storage of cached images only; removes upstream rate limits and internet egress | |||||||||||||||||||||||||||||||||||||||||||||||||||
| Lifecycle policies | Rules that expire images by age, count, or tag status | Free; the main lever on the storage line | |||||||||||||||||||||||||||||||||||||||||||||||||||
| ECR Public | Public registry with a gallery; images pullable by anyone | Free to 50 GBHow ECR Is PricedTwo meters, and a third that belongs to another service.
How Opslyft HelpsECR's real cost is split between the registry line and the NAT Gateway line that image pulls generate, and neither names the cluster doing the pulling. Opslyft shows ECR storage and the transfer around it beside the ECS, EKS, and Fargate workloads that pull the images, by team and account, and flags repositories growing without lifecycle policies and VPCs pulling through NAT without endpoints; the rest of the container cost picture is in our Kubernetes cost optimization guide. ConclusionAmazon ECR is the registry to use for anything that runs on AWS: $0.10 a gigabyte to store images, free to pull in-region, integrated with every AWS compute service, and able to scan, replicate, cache, and expire images on its own. Its bill stays small if four things are true: every repository has a lifecycle policy, every private VPC has ECR endpoints, replication goes only where images deploy, and public base images come through a cache. Where it goes wrong is the registry that never forgets and the pull that goes through NAT, neither of which the ECR line shows. For the services that consume what ECR stores, see our comparison of ECS and EKS. FAQsWhat is Amazon ECR? Amazon Elastic Container Registry (ECR) is AWS's managed registry for storing, versioning, and distributing container images and OCI artifacts. It integrates with ECS, EKS, Fargate, Lambda, and IAM, scans images for vulnerabilities, replicates them across regions and accounts, caches public images through pull-through cache rules, and expires old images with lifecycle policies. ECR Private hosts your own images; ECR Public hosts images anyone can pull. How much does Amazon ECR cost? ECR Private charges $0.10 per GB-month for stored images and standard AWS data transfer for pulls that leave the region: free to EC2, ECS, EKS, and Fargate in the same region, $0.09 per GB to the internet, and about $0.02 per GB cross-region. There is no charge per image, per pull, or per repository. Enhanced vulnerability scanning through Amazon Inspector bills per image scanned; basic scanning is free. ECR Public is free to store up to 50 GB and free to serve 500 GB a month to anonymous internet pulls, with no charge for pulls into AWS. Is pulling from ECR free? Within the same region to AWS compute, yes: no per-pull charge and no transfer charge. Pulls that cross a region pay about $0.02 per GB, pulls to the internet pay $0.09 per GB, and pulls from private subnets that route through a NAT Gateway pay the gateway's $0.045 per GB processing charge unless a VPC endpoint for ECR exists, which is the single most common hidden ECR cost. What is ECR pull-through cache? A rule that lets ECR fetch images from an upstream public registry such as Docker Hub, ECR Public, Quay, or GitHub Container Registry on first pull and cache them in your private registry, so later pulls come from ECR in your region. It removes upstream rate limits and internet egress, keeps builds working when the upstream is down, and bills only the cached images' storage at $0.10 per GB-month. How do ECR lifecycle policies save money? Lifecycle policies delete images automatically by rule: keep the last N images per tag prefix, expire untagged images after a number of days, or expire anything older than a threshold. Without them, every build pushes a new image and nothing is ever removed, so repositories grow by gigabytes a week and bill $0.10 for every one of them. A policy keeping the last 30 tagged images and expiring untagged ones after 7 days is a typical default. How does ECR pricing compare to Docker Hub and other registries? ECR has no per-seat or per-repository fee and no pull limits; you pay for storage and for transfer that leaves the region. Docker Hub charges per seat on paid plans and rate-limits anonymous pulls; GitHub Container Registry bills storage and transfer on GitHub's plans; Google Artifact Registry and Azure Container Registry bill storage with their own tiering. For workloads running on AWS, ECR is usually cheapest because in-region pulls are free. How does Opslyft show ECR costs? Opslyft shows ECR storage and the transfer around it, including the NAT Gateway processing that image pulls from private subnets generate, beside the ECS, EKS, and Fargate workloads that pull the images, by team and account, and flags repositories growing without lifecycle policies. The registry line and the network line it causes appear together, which is how the NAT charge from image pulls gets attributed to the clusters doing the pulling. Related Blogs |