aws / aws/containers-roadmap

[ECS] [feature request]: Authenticate image pulls from ECR Public in ECS/EC2 and Fargate

Open
#2,008 1 comment 18 reactions 0 assignees View on GitHub
ECS Fargate Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
What do you want us to build?

Authenticated image pulls from ECR Public in ECS

**Which service(s) is this request for?**
This could be Fargate, ECS, EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

ECR public currently allows for 10 image pulls per second from within AWS (see [ecr public quotas page](https://docs.aws.amazon.com/AmazonECR/latest/public/public-service-quotas.html)), but this quota limit is not adjustable.

Authenticated image pulls also allow 10 per second by default, but the limit is adjustable.

So customers running workloads that rely on ECR public are currently not able to easily scale beyond 10 image pulls per second.

**Are you currently working around this issue?**
How are you currently solving this problem?

Private registry auth might work, but is much less convenient than private ECR's builtin auth: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html

Alternatively, mirroring public ECR images in private ECR.

Contributor guide

Open the contributing guide

Research direction

Start with the ECR Public service quotas page and the ECS private registry authentication documentation linked in the issue, then determine which ECS/EC2 and Fargate workflows need authenticated ECR Public pulls. Done means a defined and implemented way for those workloads to authenticate and scale beyond the unauthenticated pull limit.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
authentication, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.