Air-Gapped Amazon ECR: 5 Decisions to Make Before the First Push

Moving hundreds of Helm charts and container images into an air-gapped Amazon ECR registry rarely fails on the copy. It fails weeks later, when an arm64 node can’t pull an image that silently lost its arm64 variant, or when an auditor finds one repository encrypted with the wrong key. For platform teams in regulated industries, the useful work happens before the first push, and a new AWS Containers blog post spells out which decisions can’t be undone.

The Framework

In a post on the AWS Containers blog, the authors describe an engagement with a European financial services institution running workloads in VPCs with no internet gateway and no NAT gateway. Every dependency, often dozens to hundreds of Helm charts and images, had to be brought inside the boundary. The authors’ diagnosis: the hard part is keeping the security posture consistent across a growing set of repositories, which they call “a design problem, not a scripting problem.”

Their answer is ECR repository creation templates. A template defines repository settings once, and ECR applies them automatically to any new repository matching a prefix. With the CREATE_ON_PUSH setting, the repository is created with those settings the first time an image is pushed to a matching path, so nobody pre-provisions or hand-configures repositories. The templates are written in Terraform, which makes the security posture reviewable in a pull request.

Decision 1: Customer-Managed Encryption Keys

ECR encrypts images at rest by default with an AWS managed key, but many regulated organizations need customer-managed keys in AWS KMS to control key policy, rotation and access. A repository’s encryption configuration can’t be changed after creation, so a wrong choice means creating new repositories and migrating images again. The authors advise settling the KMS strategy up front, including whether disaster recovery needs multi-Region keys.

Decision 2: Immutable Tags

The template sets tags to immutable so a tag can’t be overwritten, which protects the integrity of what was deployed and gives an audit trail. The cost is cultural: teams that overwrite a floating tag such as latest must move to versioned tags and a promotion workflow.

Decision 3: Preserve Multi-Architecture Manifests

A naive pull-and-push collapses a multi-architecture manifest list to whatever platform the migration host runs. The sample tool, ecr-artifact-manager, copies the full manifest list and verifies platforms afterward. For Helm charts, it also rewrites image references to the private ECR locations and repackages the chart so it installs without reaching the internet.

Decision 4: Credentials Out of Config Files

Source registries such as Harbor and JFrog Artifactory each need credentials. The pattern stores them in AWS Secrets Manager and retrieves them at runtime, keeping them out of source control. ECR authorization tokens last 12 hours, and source credentials should be on a rotation schedule from the start.

Decision 5: Scanning Lives at the Registry Level

Enhanced scanning is deliberately left out of the template. ECR configures scanning per registry, so setting scan-on-push and continuous scanning once covers every repository the templates create later.

Where It Doesn’t Apply

Templates only affect repositories created after they exist, so a brownfield registry needs a separate plan for older repositories. And the authors are explicit that with fewer than ten repositories, or without regulatory or air-gapped constraints, templates, Terraform modules and a migration tool may be more than a team needs. The full implementation is in the AWS sample repository. For a contrasting approach where registries pull natively rather than migrate, see Stack Archive’s look at JFrog Artifactory and GCP Artifact Registry.

Source: AWS Containers Blog

Content created with AI assistance and reviewed for accuracy.