aws / aws/containers-roadmap

[ECR] [request]: PrivateLink - Integration with Amazon S3 *interface* endpoint

Open
#1,691 2 comments 28 reactions 0 assignees View on GitHub
ECR Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
As known, ECR requires also connectivity to s3, for pulling the docker images.
If one creates a repository in `us-east-1` for example, AWS will save the corresponding images in some bucket in the same region (`us-east-1` in this example).
The case becomes trickier when it comes to using ECR's PrivateLink endpoint (specifically - in cross region orchestration).

AWS posted while ago this [article](https://aws.amazon.com/blogs/architecture/using-vpc-endpoints-in-multi-region-architectures-with-route-53-resolver/) which somewhat appears as not found in the last few weeks.
However, following this guide we can create cross-regional orchestrations which evolves many AWS services - even communicate with S3 bucket in another region using S3 VPC *Interface* (and not gateway).

The problem is that ECR works *solely* with S3 VPC *Gateway* and not interface, which doesn't allow cross-region communication (using VPC peering/ transit gateways).
So my request is as follows: integrate ECR endpoint with optional S3 VPC endpoint (instead of in addition to vpc gateway), which would allow the case from above (and many more) - as it wouldn't be bounded to only intra-regional communication (as in most available services).

**Which service(s) is this request for?**
ECR, PrivateLink, S3 Interface Endpoint

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Described above.
We run in every AWS region, and need to pull various docker containers (potentially 100+) in a daily basis.
Without the requested integration - it would make us to replicate all of our docker containers (thousands), across all regions - which is costly, harder to maintain and personally - I believe that it's really unneeded - as it makes AWS ECR Endpoint much less powerful from what it could be.
This would allow us to maintain a single registry in a single region, and pull images from multiple regions - which would simplify it as describe above.

**Are you currently working around this issue?**
I tried to find a work around, but still didn't find one.

Contributor guide

Open the contributing guide

Research direction

The issue describes ECR image pulls through AWS PrivateLink and S3 VPC interface endpoints, including cross-region orchestration with VPC peering or transit gateways. Start by reviewing the linked AWS architecture article and the stated ECR, PrivateLink, and S3 endpoint behavior. Done would mean ECR supports an optional S3 interface endpoint for cross-region image pulls.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker
Domain
cloud, infrastructure, networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.