Amazon ECR endpoints and quotas - AWS General Reference

Amazon ECR endpoints and quotas

The following are the service endpoints and service quotas for this service. To connect programmatically to an AWS service, you use an endpoint. In addition to the standard AWS endpoints, some AWS services offer FIPS endpoints in selected Regions. For more information, see AWS service endpoints. Service quotas, also referred to as limits, are the maximum number of service resources or operations for your AWS account. For more information, see AWS service quotas.

Service Endpoints

The ecr and api.ecr endpoints are used for calls to the Amazon ECR API. API actions such as DescribeImages and CreateRepository go to this endpoint. While the two endpoints function the same, the api.ecr endpoint is recommended and the default when using the AWS CLI or AWS SDKs. When connecting to Amazon ECR through an AWS PrivateLink VPC endpoint, you must use the api.ecr endpoint to make API calls. For more information, see Amazon ECR Interface VPC Endpoints (AWS PrivateLink) in the Amazon Elastic Container Registry User Guide.

For more information about FIPS endpoints, see FIPS endpoints.

Region Name Region Endpoint Protocol
US East (Ohio) us-east-2

ecr.us-east-2.amazonaws.com

api.ecr.us-east-2.amazonaws.com

ecr-fips.us-east-2.amazonaws.com

dkr.ecr-fips.us-east-2.amazonaws.com

HTTPS

HTTPS

HTTPS

HTTPS

US East (N. Virginia) us-east-1

ecr.us-east-1.amazonaws.com

api.ecr.us-east-1.amazonaws.com

ecr-fips.us-east-1.amazonaws.com

dkr.ecr-fips.us-east-1.amazonaws.com

HTTPS

HTTPS

HTTPS

HTTPS

US West (N. California) us-west-1

ecr.us-west-1.amazonaws.com

api.ecr.us-west-1.amazonaws.com

ecr-fips.us-west-1.amazonaws.com

dkr.ecr-fips.us-west-1.amazonaws.com

HTTPS

HTTPS

HTTPS

HTTPS

US West (Oregon) us-west-2

ecr.us-west-2.amazonaws.com

api.ecr.us-west-2.amazonaws.com

ecr-fips.us-west-2.amazonaws.com

dkr.ecr-fips.us-west-2.amazonaws.com

HTTPS

HTTPS

HTTPS

HTTPS

Africa (Cape Town) af-south-1

ecr.af-south-1.amazonaws.com

api.ecr.af-south-1.amazonaws.com

HTTPS

HTTPS

Asia Pacific (Hong Kong) ap-east-1

ecr.ap-east-1.amazonaws.com

api.ecr.ap-east-1.amazonaws.com

HTTPS

HTTPS

Asia Pacific (Mumbai) ap-south-1

ecr.ap-south-1.amazonaws.com

api.ecr.ap-south-1.amazonaws.com

HTTPS

HTTPS

Asia Pacific (Seoul) ap-northeast-2

ecr.ap-northeast-2.amazonaws.com

api.ecr.ap-northeast-2.amazonaws.com

HTTPS

HTTPS

Asia Pacific (Singapore) ap-southeast-1

ecr.ap-southeast-1.amazonaws.com

api.ecr.ap-southeast-1.amazonaws.com

HTTPS

HTTPS

Asia Pacific (Sydney) ap-southeast-2

ecr.ap-southeast-2.amazonaws.com

api.ecr.ap-southeast-2.amazonaws.com

HTTPS

HTTPS

Asia Pacific (Tokyo) ap-northeast-1

ecr.ap-northeast-1.amazonaws.com

api.ecr.ap-northeast-1.amazonaws.com

HTTPS

HTTPS

Canada (Central) ca-central-1

ecr.ca-central-1.amazonaws.com

api.ecr.ca-central-1.amazonaws.com

HTTPS

HTTPS

China (Beijing) cn-north-1

ecr.cn-north-1.amazonaws.com.cn

api.ecr.cn-north-1.amazonaws.com.cn

HTTPS

HTTPS

China (Ningxia) cn-northwest-1

ecr.cn-northwest-1.amazonaws.com.cn

api.ecr.cn-northwest-1.amazonaws.com.cn

HTTPS

HTTPS

Europe (Frankfurt) eu-central-1

ecr.eu-central-1.amazonaws.com

api.ecr.eu-central-1.amazonaws.com

HTTPS

HTTPS

Europe (Ireland) eu-west-1

ecr.eu-west-1.amazonaws.com

api.ecr.eu-west-1.amazonaws.com

HTTPS

HTTPS

Europe (London) eu-west-2

ecr.eu-west-2.amazonaws.com

api.ecr.eu-west-2.amazonaws.com

HTTPS

HTTPS

Europe (Milan) eu-south-1

ecr.eu-south-1.amazonaws.com

api.ecr.eu-south-1.amazonaws.com

HTTPS

HTTPS

Europe (Paris) eu-west-3

ecr.eu-west-3.amazonaws.com

api.ecr.eu-west-3.amazonaws.com

HTTPS

HTTPS

Europe (Stockholm) eu-north-1

ecr.eu-north-1.amazonaws.com

api.ecr.eu-north-1.amazonaws.com

HTTPS

HTTPS

Middle East (Bahrain) me-south-1

ecr.me-south-1.amazonaws.com

api.ecr.me-south-1.amazonaws.com

HTTPS

HTTPS

South America (São Paulo) sa-east-1

ecr.sa-east-1.amazonaws.com

api.ecr.sa-east-1.amazonaws.com

HTTPS

HTTPS

AWS GovCloud (US-East) us-gov-east-1

ecr.us-gov-east-1.amazonaws.com

api.ecr.us-gov-east-1.amazonaws.com

ecr-fips.us-gov-east-1.amazonaws.com

dkr.ecr-fips.us-gov-east-1.amazonaws.com

HTTPS

HTTPS

HTTPS

HTTPS

AWS GovCloud (US) us-gov-west-1

ecr.us-gov-west-1.amazonaws.com

api.ecr.us-gov-west-1.amazonaws.com

ecr-fips.us-gov-west-1.amazonaws.com

dkr.ecr-fips.us-gov-west-1.amazonaws.com

HTTPS

HTTPS

HTTPS

HTTPS

Docker and OCI client endpoints

The Docker and OCI client endpoints are used for the Docker Registry APIs. Docker client commands such as push and pull use this endpoint.

For more information about FIPS endpoints, see FIPS endpoints.

Region Name Region Endpoint Protocol
US East (Ohio) us-east-2

<registry-id>.dkr.ecr.us-east-2.amazonaws.com

<registry-id>.dkr.ecr-fips.us-east-2.amazonaws.com

HTTPS
US East (N. Virginia) us-east-1

<registry-id>.dkr.ecr.us-east-1.amazonaws.com

<registry-id>.dkr.ecr-fips.us-east-1.amazonaws.com

HTTPS
US West (N. California) us-west-1

<registry-id>.dkr.ecr.us-west-1.amazonaws.com

<registry-id>.dkr.ecr-fips.us-west-1.amazonaws.com

HTTPS
US West (Oregon) us-west-2

<registry-id>.dkr.ecr.us-west-2.amazonaws.com

<registry-id>.dkr.ecr-fips.us-west-2.amazonaws.com

HTTPS
Asia Pacific (Hong Kong) ap-east-1

<registry-id>.dkr.ecr.ap-east-1.amazonaws.com

HTTPS
Asia Pacific (Mumbai) ap-south-1

<registry-id>.dkr.ecr.ap-south-1.amazonaws.com

HTTPS
Asia Pacific (Seoul) ap-northeast-2

<registry-id>.dkr.ecr.ap-northeast-2.amazonaws.com

HTTPS
Asia Pacific (Singapore) ap-southeast-1

<registry-id>.dkr.ecr.ap-southeast-1.amazonaws.com

HTTPS
Asia Pacific (Sydney) ap-southeast-2

<registry-id>.dkr.ecr.ap-southeast-2.amazonaws.com

HTTPS
Asia Pacific (Tokyo) ap-northeast-1

<registry-id>.dkr.ecr.ap-northeast-1.amazonaws.com

HTTPS
Canada (Central) ca-central-1

<registry-id>.dkr.ecr.ca-central-1.amazonaws.com

HTTPS
China (Beijing) cn-north-1

<registry-id>.dkr.ecr.cn-north-1.amazonaws.com.cn

HTTPS
China (Ningxia) cn-northwest-1

<registry-id>.dkr.ecr.cn-northwest-1.amazonaws.com.cn

HTTPS
Europe (Frankfurt) eu-central-1

<registry-id>.dkr.ecr.eu-central-1.amazonaws.com

HTTPS
Europe (Ireland) eu-west-1

<registry-id>.dkr.ecr.eu-west-1.amazonaws.com

HTTPS
Europe (London) eu-west-2

<registry-id>.dkr.ecr.eu-west-2.amazonaws.com

HTTPS
Europe (Paris) eu-west-3

<registry-id>.dkr.ecr.eu-west-3.amazonaws.com

HTTPS
Europe (Stockholm) eu-north-1

<registry-id>.dkr.ecr.eu-north-1.amazonaws.com

HTTPS
Middle East (Bahrain) me-south-1

<registry-id>.dkr.ecr.me-south-1.amazonaws.com

HTTPS
South America (São Paulo) sa-east-1

<registry-id>.dkr.ecr.sa-east-1.amazonaws.com

HTTPS
AWS GovCloud (US-East) us-gov-east-1

<registry-id>.dkr.ecr.us-gov-east-1.amazonaws.com

<registry-id>.dkr.ecr-fips.us-gov-east-1.amazonaws.com

HTTPS
AWS GovCloud (US-West) us-gov-west-1

<registry-id>.dkr.ecr.us-gov-west-1.amazonaws.com

<registry-id>.dkr.ecr-fips.us-gov-west-1.amazonaws.com

HTTPS

For information about using Amazon ECR in the China Regions, see:

Service Quotas

The following table provides the default limits for Amazon Elastic Container Registry (Amazon ECR).

Service quota Description Default quota value

Registered repositories

The maximum number of repositories that you can create per Region.

10,000

Image per repository

The maximum number of images per repository.

10,000

The following table provides the default rate quotas for each of the Amazon ECR API actions involved with the image push and image pull actions.

Amazon ECR action API operation Description Default quota value

Authentication

Rate of GetAuthorizationToken requests

The rate of GetAuthorizationToken API requests that you can make per second, per Region.

200

Image push

Rate of BatchCheckLayerAvailability requests

The rate of BatchCheckLayerAvailability API requests that you can make per second, per Region.

When an image is pushed to a repository, each image layer is checked to verify if it has been uploaded before. If it has been uploaded, then the image layer is skipped.

200

Rate of InitiateLayerUpload requests

The rate of InitiateLayerUpload API requests that you can make per second, per Region.

When an image is pushed, the InitiateLayerUpload API is called once per image layer that has not already been uploaded. Whether or not an image layer has been uploaded is determined by the BatchCheckLayerAvailability API action.

10

Rate of CompleteLayerUpload requests

The rate of CompleteLayerUpload API requests that you can make per second, per Region.

When an image is pushed, the CompleteLayerUpload API is called once per each new image layer to verify that the upload has completed.

10

Rate of UploadLayerPart requests

The rate of UploadLayerPart API requests that you can make per second, per Region.

When an image is pushed, each new image layer is uploaded in parts. The maximum size of each image layer part can be 20,971,520 bytes (or about 20MB). The UploadLayerPart API is called once per each new image layer part.

260

Rate of PutImage requests

The rate of PutImage API requests that you can make per second, per Region.

When an image is pushed and all new image layers have been uploaded, the PutImage API is called once to create or update the image manifest and the tags associated with the image.

10

Image pull

Rate of BatchGetImage requests

The rate of BatchGetImage API requests that you can make per second, per Region.

When an image is pulled, the BatchGetImage API is called once to retrieve the image manifest.

1,000
Rate of GetDownloadUrlForLayer requests

The rate of GetDownloadUrlForLayer API requests that you can make per second, per Region.

When an image is pulled, the GetDownloadUrlForLayer API is called once per image layer that is not already cached.

1,500

The following table provides other quotas for Amazon ECR and Docker images that cannot be changed.

Note

The layer part information mentioned in the following table is only applicable if you are calling the Amazon ECR API actions directly to initiate multipart uploads for image push operations. This is a rare action. We recommend that you use the Docker CLI to pull, tag, and push images.

Service quota Description Quota value

Layer parts

The maximum number of layer parts. This is only applicable if you are using Amazon ECR API actions directly to initiate multipart uploads for image push operations.

1,000

Maximum layer size

The maximum size (MiB) of a layer. **

10,000

Minimum layer part size

The minimum size (MiB) of a layer part. This is only applicable if you are using Amazon ECR API actions directly to initiate multipart uploads for image push operations.

5

Maximum layer part size

The maximum size (MiB) of a layer part. This is only applicable if you are using Amazon ECR API actions directly to initiate multipart uploads for image push operations.

10

Tags per image

The maximum number of tags per image.

1000

Lifecycle policy length

The maximum number of characters in a lifecycle policy.

30,720

Rules per lifecycle policy

The maximum number of rules in a lifecycle policy.

50

Rate of image scans

The maximum number of image scans per image, per day.

1

** The maximum layer size listed here is calculated by multiplying the maximum layer part size (10 MiB) by the maximum number of layer parts (1,000).

For more information, see Amazon ECR Service Quotas in the Amazon Elastic Container Registry User Guide.