---
sidebar_label: AWS ECR
doc_id: 38b35379-9995-4f28-ad21-808693aa1327
description: >-
  Configure AWS ECR integration for Docker image storage, CI/CD pipelines, and
  cross-account access
keywords:
  - AWS ECR
  - Docker
  - container registry
  - CI/CD
  - cross-account access
title: AWS ECR
canonical: >-
  https://docs.nullplatform.com/docs/providers/supported-integrations/assets-repository/ecr
---
# AWS ECR

Defines the settings for AWS ECR integration, including CI/CD and assets

**Type**: `ecr`

**Properties**

|Name|Type|Description|Required|
|----|----|-----------|--------|
|[**ci**](#ci)<br/>(CI/CD Image Push Configuration)|`object`|Set up credentials for writing and pushing Docker images to ECR as part of your CI/CD pipelines<br/>|yes|
|[**read**](#read)<br/>(Cross\-Account Pull Access)|`object`|Configure permissions for pulling Docker images from a centralized ECR repository across AWS accounts<br/>|no|
|[**setup**](#setup)<br/>(Storage configuration)|`object`|Configure base settings for storing Docker builds in your ECR repository<br/>|yes|

**Additional Properties:** not allowed  
**Example**

```json
{
    "ci": {
        "region": "us-east-1"
    },
    "read": {
        "region": "us-east-1",
        "role_arn": "arn:aws:iam::123456789012:role/ecr-read-role"
    },
    "setup": {
        "region": "us-east-1",
        "role_arn": "arn:aws:iam::123456789012:role/ecr-access-role",
        "naming_rule": "\"\\(.namespace.slug)/\\(.application.slug)\""
    }
}
```

<a name="ci"></a>
## ci: CI/CD Image Push Configuration

Set up credentials for writing and pushing Docker images to ECR as part of your CI/CD pipelines

**Properties**

|Name|Type|Description|Required|
|----|----|-----------|--------|
|**region**<br/>(AWS Region)|`string`|AWS region for CI/CD operations<br/>Enum: `"us-east-1"`, `"us-east-2"`, `"us-west-1"`, `"us-west-2"`, `"eu-west-1"`, `"eu-west-2"`, `"eu-west-3"`, `"eu-central-1"`, `"eu-north-1"`, `"ap-southeast-1"`, `"ap-southeast-2"`, `"ap-northeast-1"`, `"ap-northeast-2"`, `"ap-south-1"`, `"sa-east-1"`, `"ca-central-1"`, `"me-south-1"`, `"af-south-1"`<br/>|yes|
|**access\_key**|`string`|AWS access key for CI/CD pipeline<br/>Minimal Length: `20`<br/>Maximal Length: `20`<br/>Pattern: `^[A-Z0-9]{20}$`<br/>|no|
|**secret\_key**|`string`|AWS secret key for CI/CD pipeline<br/>Minimal Length: `1`<br/>|no|

**Additional Properties:** not allowed  
**Example**

```json
{
    "region": "us-east-1"
}
```

<a name="read"></a>
## read: Cross\-Account Pull Access

Configure permissions for pulling Docker images from a centralized ECR repository across AWS accounts

**Properties**

|Name|Type|Description|Required|
|----|----|-----------|--------|
|**region**<br/>(ECR Region)|`string`|AWS region where the centralized Amazon ECR repository is located<br/>Enum: `"us-east-1"`, `"us-east-2"`, `"us-west-1"`, `"us-west-2"`, `"eu-west-1"`, `"eu-west-2"`, `"eu-west-3"`, `"eu-central-1"`, `"eu-north-1"`, `"ap-southeast-1"`, `"ap-southeast-2"`, `"ap-northeast-1"`, `"ap-northeast-2"`, `"ap-south-1"`, `"sa-east-1"`, `"ca-central-1"`, `"me-south-1"`, `"af-south-1"`<br/>||
|**role\_arn**<br/>(Assume Role ARN)|`string`|Intermediate IAM role ARN that will be assumed to pull Docker images from the centralized ECR repository<br/>Minimal Length: `1`<br/>Pattern: `^arn:aws:iam::[0-9]{12}:role/[a-zA-Z0-9+=,.@_-]+$`<br/>||

**Additional Properties:** not allowed  
**Example**

```json
{
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::123456789012:role/ecr-read-role"
}
```

<a name="setup"></a>
## setup: Storage configuration

Configure base settings for storing Docker builds in your ECR repository

**Properties**

|Name|Type|Description|Required|
|----|----|-----------|--------|
|**policy**<br/>(Repository Policy)|`string`|ECR repository access policy as a JSON string<br/>|no|
|**region**<br/>(AWS Region)|`string`|AWS region for ECR<br/>Enum: `"us-east-1"`, `"us-east-2"`, `"us-west-1"`, `"us-west-2"`, `"eu-west-1"`, `"eu-west-2"`, `"eu-west-3"`, `"eu-central-1"`, `"eu-north-1"`, `"ap-southeast-1"`, `"ap-southeast-2"`, `"ap-northeast-1"`, `"ap-northeast-2"`, `"ap-south-1"`, `"sa-east-1"`, `"ca-central-1"`, `"me-south-1"`, `"af-south-1"`<br/>|yes|
|**role\_arn**|`string`|AWS IAM role ARN for ECR access<br/>Minimal Length: `1`<br/>Pattern: `^arn:aws:iam::[0-9]{12}:role/[a-zA-Z0-9+=,.@_-]+$`<br/>|no|
|**external\_id**<br/>(Role External ID)|`string`|External ID for the main IAM role<br/>Minimal Length: `1`<br/>|no|
|**naming\_rule**|`string`|Specifies the naming convention for the ECR repository.<br/>The following `jq` context variables are available: `account`, `namespace`, and `application`<br/>Default: `"\"\\(.namespace.slug)/\\(.application.slug)\""`<br/>|no|
|**intermediate\_role**|`string`|Intermediate IAM role for cross-account access<br/>Minimal Length: `1`<br/>Pattern: `^arn:aws:iam::[0-9]{12}:role/[a-zA-Z0-9+=,.@_-]+$`<br/>|no|
|**intermediate\_external\_id**<br/>(Intermediate Role External ID)|`string`|External ID for the intermediate IAM role<br/>Minimal Length: `1`<br/>|no|

**Additional Properties:** not allowed  
**Example**

```json
{
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::123456789012:role/ecr-access-role",
    "naming_rule": "\"\\(.namespace.slug)/\\(.application.slug)\""
}
```