[ECR] [request]: PrivateLink - Integration with Amazon S3 *interface* endpoint
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
As known, ECR requires also connectivity to s3, for pulling the docker images.
If one creates a repository in `us-east-1` for example, AWS will save the corresponding images in some bucket in the same region (`us-east-1` in this example).
The case becomes trickier when it comes to using ECR's PrivateLink endpoint (specifically - in cross region orchestration).
AWS posted while ago this [article](https://aws.amazon.com/blogs/architecture/using-vpc-endpoints-in-multi-region-architectures-with-route-53-resolver/) which somewhat appears as not found in the last few weeks.
However, following this guide we can create cross-regional orchestrations which evolves many AWS services - even communicate with S3 bucket in another region using S3 VPC *Interface* (and not gateway).
The problem is that ECR works *solely* with S3 VPC *Gateway* and not interface, which doesn't allow cross-region communication (using VPC peering/ transit gateways).
So my request is as follows: integrate ECR endpoint with optional S3 VPC endpoint (instead of in addition to vpc gateway), which would allow the case from above (and many more) - as it wouldn't be bounded to only intra-regional communication (as in most available services).
**Which service(s) is this request for?**
ECR, PrivateLink, S3 Interface Endpoint
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Described above.
We run in every AWS region, and need to pull various docker containers (potentially 100+) in a daily basis.
Without the requested integration - it would make us to replicate all of our docker containers (thousands), across all regions - which is costly, harder to maintain and personally - I believe that it's really unneeded - as it makes AWS ECR Endpoint much less powerful from what it could be.
This would allow us to maintain a single registry in a single region, and pull images from multiple regions - which would simplify it as describe above.
**Are you currently working around this issue?**
I tried to find a work around, but still didn't find one.
Contributor guide
Research direction
The issue describes ECR image pulls through AWS PrivateLink and S3 VPC interface endpoints, including cross-region orchestration with VPC peering or transit gateways. Start by reviewing the linked AWS architecture article and the stated ECR, PrivateLink, and S3 endpoint behavior. Done would mean ECR supports an optional S3 interface endpoint for cross-region image pulls.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker
- Domain
- cloud, infrastructure, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100