Amazon ECR stores, manages, and deploys Docker container images with tight integration into ECS, EKS, and Fargate. The pricing is simple: you pay for storage and data transfer. However, without lifecycle policies, image storage can grow silently and become a significant cost over time, especially in CI/CD environments that push images on every commit.
TL;DR: ECR private repositories cost $0.10/GB-month for storage with standard data transfer rates. ECR Public offers 50 GB free storage and 500 GB free monthly bandwidth for anonymous users (unlimited for authenticated AWS users). Implement lifecycle policies to automatically clean up old images, as a single repository can easily accumulate hundreds of GB without cleanup.
Private Repository Pricing
| Component | Price |
|---|---|
| Storage | $0.10/GB-month |
| Data Transfer (same region) | Free |
| Data Transfer (cross-region) | $0.01-$0.02/GB |
| Data Transfer (to internet) | $0.09/GB (first 10 TB) |
| Image Scanning (basic) | Free |
| Image Scanning (enhanced) | Based on Inspector pricing |
Storage Cost Examples
Container images vary widely in size. A minimal Alpine-based image might be 50 MB, while a full application image with dependencies can exceed 1 GB. Here is how storage costs accumulate:
| Scenario | Images | Avg Size | Total Storage | Monthly Cost |
|---|---|---|---|---|
| Small team (5 services) | 50 images | 200 MB | 10 GB | $1.00 |
| Active CI/CD (20 services) | 500 images | 500 MB | 250 GB | $25.00 |
| Large org (100 services) | 5,000 images | 500 MB | 2,500 GB | $250.00 |
Without lifecycle policies, the active CI/CD scenario would grow by 250 GB per month, reaching 3 TB ($300/month) within a year.
Public Repository Pricing
| Component | Free Tier | Beyond Free Tier |
|---|---|---|
| Storage | 50 GB | $0.10/GB-month |
| Bandwidth (anonymous) | 500 GB/month | $0.09/GB |
| Bandwidth (authenticated AWS) | Unlimited | Free |
ECR Public vs Docker Hub
ECR Public is a strong alternative to Docker Hub for open-source projects. Docker Hub limits anonymous pulls to 100 per 6 hours per IP, while ECR Public provides 500 GB of free anonymous bandwidth with no rate limiting. Authenticated AWS users get unlimited pulls at no cost.
For organizations pulling base images frequently, authenticating with ECR Public eliminates the bandwidth costs and rate limits that Docker Hub imposes on free tier users.
Data Transfer Costs
| Direction | Cost |
|---|---|
| ECR to ECS/EKS (same region) | Free |
| ECR to EC2 (same region) | Free |
| ECR to Lambda (same region) | Free |
| Cross-region pull | $0.01-$0.02/GB |
| To internet | $0.09/GB (first 10 TB) |
Data transfer within the same AWS region is free for all compute services. This means pulling images from ECR into ECS tasks, EKS pods, or Lambda functions in the same region costs nothing. Cross-region pulls incur standard data transfer rates, so replicate frequently used images to each region using ECR replication.
Image Lifecycle Policies
Lifecycle policies are the single most important cost control mechanism for ECR. Without them, every image pushed remains stored indefinitely.
| Policy Type | Example Rule | Impact |
|---|---|---|
| Keep last N images | Retain last 10 tagged images | Prevents unbounded growth |
| Age-based expiry | Delete untagged images older than 7 days | Cleans up failed builds |
| Tag prefix | Keep images tagged "release-*" for 90 days | Retains important versions |
A typical lifecycle policy should:
- Keep the last 5-10 tagged images per repository
- Delete untagged images after 1-3 days
- Retain images tagged with release or production prefixes for 90 days
For a team pushing 20 images per day at 500 MB each, a lifecycle policy keeping only the last 10 images reduces storage from 300 GB/month (growing) to a constant 10 GB, saving $29/month per repository.
Image Scanning
| Scanning Type | Cost |
|---|---|
| Basic Scanning | Free (on push or manual) |
| Enhanced Scanning (Inspector) | $0.09/image initial, $0.01/rescan |
Basic scanning uses the open-source Clair project to detect known vulnerabilities. Enhanced scanning uses Amazon Inspector for continuous monitoring and deeper analysis including OS and programming language package vulnerabilities.
For cost-sensitive environments, basic scanning provides adequate vulnerability detection at no cost. Enable scan-on-push to automatically scan every new image.
Cost Optimization Strategies
-
Implement lifecycle policies immediately. This is non-negotiable. Every ECR repository should have a lifecycle policy from day one. A single repository without cleanup can accumulate hundreds of dollars in storage within months.
-
Use multi-stage Docker builds. Reduce image sizes by 50-80% with multi-stage builds that exclude build tools, source code, and development dependencies from the final image. Smaller images mean lower storage and transfer costs.
-
Share base layers across images. ECR stores Docker layers, not full images. Services built on the same base image share layers, so only unique layers consume additional storage. Standardize on common base images across your organization.
-
Enable cross-region replication selectively. Only replicate images to regions where they are actively deployed. Replicating to unused regions wastes storage costs. Configure replication rules with repository filters to limit which images get replicated.
-
Pull from ECR Public authenticated. When using public images as base layers, authenticate your pulls with AWS credentials to get unlimited free bandwidth instead of the 500 GB anonymous limit.
-
Use image tag immutability. Enable tag immutability to prevent overwriting existing tags. This avoids accidentally replacing production images and ensures lifecycle policies work predictably.
Related Guides
FAQ
How much does ECR cost for a small team?
A small team with 5-10 services and proper lifecycle policies (keeping the last 10 images per repo) typically pays $1-5/month for ECR storage. Without lifecycle policies, the same team could pay $20-50/month within six months as old images accumulate.
Is ECR cheaper than Docker Hub Pro?
For teams already on AWS, ECR is typically cheaper. Docker Hub Pro costs $5/user/month with unlimited private repositories. ECR charges only for storage used ($0.10/GB-month) with no per-user fees. A team of 10 developers paying $50/month for Docker Hub Pro would pay $2-10/month on ECR depending on image volume.
Does ECR charge for image pulls?
ECR does not charge per pull. You pay only for storage and data transfer. Same-region pulls to ECS, EKS, and Lambda are completely free. This makes ECR significantly cheaper than registries that charge per pull for high-frequency deployment environments.
Lower Your ECR Storage Costs with Wring
Wring helps you access AWS credits and volume discounts to lower your ECR storage costs. Through group buying power, Wring negotiates better rates so you pay less per GB stored.
