AWS Elastic Container Registry (ECR)

🔐 Setup Required (Private)

The ecr registry module lets you authenticate against private AWS Elastic Container Registry (ECR) repositories and monitor public images from public.ecr.aws.

Zero-Config for Public Images

Public images from public.ecr.aws work out of the box with zero configuration via the default ecr.public provider. AWS credentials are only required to authenticate against private ECR repositories.

---

⚙️ Configuration Variables

WUD_REGISTRY_ECR_{registry_name}_ACCESSKEYID

Optionalstring

AWS IAM Access Key ID (required for private ECR registries)

Allowed values:[AWS Access Key ID](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html)

WUD_REGISTRY_ECR_{registry_name}_ACCOUNTID

Optionalstringdefault: Derived from image name

AWS Account ID (used to filter when multiple accounts are configured)

Allowed values:12-digit numeric string

WUD_REGISTRY_ECR_{registry_name}_PUBLIC

Optionalbooleandefault: false

Whether the registry is an ECR Public gallery. When set to true, AWS credentials are not required.

WUD_REGISTRY_ECR_{registry_name}_REGION

Optionalstringdefault: us-east-1 (when public)

AWS Region Code (required for private ECR registries, defaults to us-east-1 when PUBLIC=true)

Allowed values:[AWS Region Code](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints) (e.g. `us-east-1`, `eu-west-1`)

WUD_REGISTRY_ECR_{registry_name}_SECRETACCESSKEY

Optionalstring

AWS IAM Secret Access Key (required for private ECR registries)

Allowed values:[AWS Secret Access Key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html)

Required IAM Policy for Private Registries

Ensure the AmazonEC2ContainerRegistryReadOnly policy (or equivalent ecr:GetAuthorizationToken, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer permissions) is attached to the IAM user.

---

🚀 Examples

Monitor Public AWS ECR Images (public.ecr.aws)

Public images (for example public.ecr.aws/docker/library/traefik:latest) work automatically without any configuration.

Authenticate with Private AWS ECR

Docker Compose

services:
  whatsupdocker:
    image: getwud/wud
    environment:
      - WUD_REGISTRY_ECR_PRIVATE_ACCESSKEYID=AKIAIOSFODNN7EXAMPLE
      - WUD_REGISTRY_ECR_PRIVATE_SECRETACCESSKEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
      - WUD_REGISTRY_ECR_PRIVATE_REGION=eu-west-1

Docker

docker run \
  -e WUD_REGISTRY_ECR_PRIVATE_ACCESSKEYID="AKIAIOSFODNN7EXAMPLE" \
  -e WUD_REGISTRY_ECR_PRIVATE_SECRETACCESSKEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \
  -e WUD_REGISTRY_ECR_PRIVATE_REGION="eu-west-1" \
  getwud/wud

---

📖 Setup Guide: Creating an AWS IAM User for ECR

1. Create an IAM User

Open the AWS IAM Console and create a new IAM user.

2. Attach the Read-Only Policy

Attach the AmazonEC2ContainerRegistryReadOnly managed policy to the user.

3. Generate Access Keys

Create an Access Key under Security credentials, and copy the Access Key ID and Secret Access Key.