Amazon ECS Task and Private ECR Image Pull Configuration

Same Account ECR Image Pull

Yes, an Amazon ECS task can pull images from a private ECR repository in the same account with the proper IAM permissions. The ECS task execution role needs the following permissions:

• ecr:GetDownloadUrlForLayer
• ecr:BatchGetImage
• ecr:BatchCheckLayerAvailability

These permissions are typically included in the AmazonECSTaskExecutionRolePolicy managed policy. When you create an ECS task definition, you specify the task execution role that has these permissions.

Cross-Account ECR Image Pull

1-1. Landing Zone Environment (Account A pulling from Account B)

Yes, you can pull ECR images across accounts within your organization. To do this:

1. In Account B (image owner):

• Create a resource-based policy on the ECR repository that grants permission to Account A
• Example policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCrossAccountPull",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::ACCOUNT-A-ID:root"
},
"Action": [
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchCheckLayerAvailability"
]
}
]
}

2. In Account A (image consumer):

• Ensure the ECS task execution role has permissions to pull from the cross-account repository
• Reference the full ECR image URI in your task definition: ACCOUNT-B-ID.dkr.ecr.region.amazonaws.com/repository-name:tag

1-2. Cross-Organization ECR Image Pull

Yes, you can pull ECR images from another organization's account with proper permissions:

1. In the external organization's account:

• They must add a resource-based policy to their ECR repository that explicitly grants your account access
• Similar to the cross-account policy above, but with your organization's account ID

2. In your account:

• Your ECS task execution role needs the same permissions as mentioned earlier
• Reference the full ECR image URI in your task definition

This approach works across any AWS accounts, regardless of organizational relationship, as long as proper permissions are granted.

Network Flow with and without PrivateLink

With PrivateLink (VPC Endpoint for ECR)

When you have PrivateLink configured for ECR:

1. The ECS task in your VPC initiates a request to pull an image
2. The request goes through the VPC endpoint for ECR (com.amazonaws.region.ecr.dkr)
3. Traffic stays within the AWS network backbone and never leaves the AWS network
4. The ECR service processes the request and returns the image through the same private connection

This provides enhanced security as traffic doesn't traverse the public internet, and you maintain enterprise-grade security through IPv6-aware security groups and VPC Flow Logs monitoring.

Without PrivateLink

Without PrivateLink configured:

1. The ECS task in your VPC initiates a request to pull an image
2. The request is routed to a NAT Gateway (if in a private subnet) or directly (if in a public subnet)
3. Traffic exits your VPC and traverses the public internet
4. The request reaches the ECR service endpoint (11111111.dkr.ecr.ap-northeast-2.amazonaws.com/hc-test-api)
5. The response follows the same path back

This approach exposes your traffic to the public internet, which may have security and performance implications.

Using PrivateLink is recommended for enhanced security, reduced latency, and improved reliability when working with ECR images, especially in production environments.
Sources
Amazon ECS announces IPv6-only support | Containers
SEC09-BP03 Authenticate network communications - AWS Well-Architected Framework