Amazon ECR endpoints and quotas
The following are the service endpoints and service quotas for this service. To connect programmatically to an AWS service, you use an endpoint. In addition to the standard AWS endpoints, some AWS services offer FIPS endpoints in selected Regions. For more information, see AWS service endpoints. Service quotas, also referred to as limits, are the maximum number of service resources or operations for your AWS account. For more information, see AWS service quotas.
Service endpoints
The ecr and api.ecr endpoints are used for calls to the Amazon ECR
API. API actions such as DescribeImages and CreateRepository go to
this endpoint. While the two endpoints function the same, the api.ecr endpoint is
recommended and the default when using the AWS CLI or AWS SDKs. When connecting to Amazon ECR
through an AWS PrivateLink VPC endpoint, you must use the api.ecr endpoint to make
API calls. For more information, see Amazon ECR Interface VPC Endpoints (AWS PrivateLink) in the Amazon Elastic Container Registry User Guide.
For more information about FIPS endpoints, see FIPS endpoints.
| Region Name | Region | Endpoint | Protocol |
|---|---|---|---|
| US East (Ohio) | us-east-2 |
ecr.us-east-2.amazonaws.com ecr-fips.us-east-2.amazonaws.com api.ecr.us-east-2.amazonaws.com dkr.ecr-fips.us-east-2.amazonaws.com |
HTTPS HTTPS HTTPS HTTPS |
| US East (N. Virginia) | us-east-1 |
ecr.us-east-1.amazonaws.com dkr.ecr-fips.us-east-1.amazonaws.com api.ecr.us-east-1.amazonaws.com ecr-fips.us-east-1.amazonaws.com |
HTTPS HTTPS HTTPS HTTPS |
| US West (N. California) | us-west-1 |
ecr.us-west-1.amazonaws.com dkr.ecr-fips.us-west-1.amazonaws.com api.ecr.us-west-1.amazonaws.com ecr-fips.us-west-1.amazonaws.com |
HTTPS HTTPS HTTPS HTTPS |
| US West (Oregon) | us-west-2 |
ecr.us-west-2.amazonaws.com ecr-fips.us-west-2.amazonaws.com api.ecr.us-west-2.amazonaws.com dkr.ecr-fips.us-west-2.amazonaws.com |
HTTPS HTTPS HTTPS HTTPS |
| Africa (Cape Town) | af-south-1 |
ecr.af-south-1.amazonaws.com api.ecr.af-south-1.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Hong Kong) | ap-east-1 |
ecr.ap-east-1.amazonaws.com api.ecr.ap-east-1.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Hyderabad) | ap-south-2 |
ecr.ap-south-2.amazonaws.com api.ecr.ap-south-2.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Jakarta) | ap-southeast-3 |
ecr.ap-southeast-3.amazonaws.com api.ecr.ap-southeast-3.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Melbourne) | ap-southeast-4 |
ecr.ap-southeast-4.amazonaws.com api.ecr.ap-southeast-4.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Mumbai) | ap-south-1 |
ecr.ap-south-1.amazonaws.com api.ecr.ap-south-1.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Osaka) | ap-northeast-3 |
ecr.ap-northeast-3.amazonaws.com api.ecr.ap-northeast-3.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Seoul) | ap-northeast-2 |
ecr.ap-northeast-2.amazonaws.com api.ecr.ap-northeast-2.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Singapore) | ap-southeast-1 |
ecr.ap-southeast-1.amazonaws.com api.ecr.ap-southeast-1.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Sydney) | ap-southeast-2 |
ecr.ap-southeast-2.amazonaws.com api.ecr.ap-southeast-2.amazonaws.com |
HTTPS HTTPS |
| Asia Pacific (Tokyo) | ap-northeast-1 |
ecr.ap-northeast-1.amazonaws.com api.ecr.ap-northeast-1.amazonaws.com |
HTTPS HTTPS |
| Canada (Central) | ca-central-1 |
ecr.ca-central-1.amazonaws.com api.ecr.ca-central-1.amazonaws.com |
HTTPS HTTPS |
| Canada West (Calgary) | ca-west-1 |
ecr.ca-west-1.amazonaws.com api.ecr.ca-west-1.amazonaws.com |
HTTPS HTTPS |
| Europe (Frankfurt) | eu-central-1 |
ecr.eu-central-1.amazonaws.com api.ecr.eu-central-1.amazonaws.com |
HTTPS HTTPS |
| Europe (Ireland) | eu-west-1 |
ecr.eu-west-1.amazonaws.com api.ecr.eu-west-1.amazonaws.com |
HTTPS HTTPS |
| Europe (London) | eu-west-2 |
ecr.eu-west-2.amazonaws.com api.ecr.eu-west-2.amazonaws.com |
HTTPS HTTPS |
| Europe (Milan) | eu-south-1 |
ecr.eu-south-1.amazonaws.com api.ecr.eu-south-1.amazonaws.com |
HTTPS HTTPS |
| Europe (Paris) | eu-west-3 |
ecr.eu-west-3.amazonaws.com api.ecr.eu-west-3.amazonaws.com |
HTTPS HTTPS |
| Europe (Spain) | eu-south-2 |
ecr.eu-south-2.amazonaws.com api.ecr.eu-south-2.amazonaws.com |
HTTPS HTTPS |
| Europe (Stockholm) | eu-north-1 |
ecr.eu-north-1.amazonaws.com api.ecr.eu-north-1.amazonaws.com |
HTTPS HTTPS |
| Europe (Zurich) | eu-central-2 |
ecr.eu-central-2.amazonaws.com api.ecr.eu-central-2.amazonaws.com |
HTTPS HTTPS |
| Israel (Tel Aviv) | il-central-1 |
ecr.il-central-1.amazonaws.com api.ecr.il-central-1.amazonaws.com |
HTTPS HTTPS |
| Middle East (Bahrain) | me-south-1 |
ecr.me-south-1.amazonaws.com api.ecr.me-south-1.amazonaws.com |
HTTPS HTTPS |
| Middle East (UAE) | me-central-1 |
ecr.me-central-1.amazonaws.com api.ecr.me-central-1.amazonaws.com |
HTTPS HTTPS |
| South America (São Paulo) | sa-east-1 |
ecr.sa-east-1.amazonaws.com api.ecr.sa-east-1.amazonaws.com |
HTTPS HTTPS |
| AWS GovCloud (US-East) | us-gov-east-1 |
ecr.us-gov-east-1.amazonaws.com ecr-fips.us-gov-east-1.amazonaws.com api.ecr.us-gov-east-1.amazonaws.com dkr.ecr-fips.us-gov-east-1.amazonaws.com |
HTTPS HTTPS HTTPS HTTPS |
| AWS GovCloud (US-West) | us-gov-west-1 |
ecr.us-gov-west-1.amazonaws.com dkr.ecr-fips.us-gov-west-1.amazonaws.com ecr-fips.us-gov-west-1.amazonaws.com api.ecr.us-gov-west-1.amazonaws.com |
HTTPS HTTPS HTTPS HTTPS |
Docker and OCI client endpoints
The Docker and OCI client endpoints are used for the Docker Registry APIs. Docker client
commands such as push and pull use this endpoint.
For more information about FIPS endpoints, see FIPS endpoints.
| Region Name | Region | Endpoint | Protocol |
|---|---|---|---|
| US East (Ohio) | us-east-2 |
|
HTTPS |
| US East (N. Virginia) | us-east-1 |
|
HTTPS |
| US West (N. California) | us-west-1 |
|
HTTPS |
| US West (Oregon) | us-west-2 |
|
HTTPS |
| Asia Pacific (Hong Kong) | ap-east-1 |
|
HTTPS |
| Asia Pacific (Mumbai) | ap-south-1 |
|
HTTPS |
| Asia Pacific (Seoul) | ap-northeast-2 |
|
HTTPS |
| Asia Pacific (Singapore) | ap-southeast-1 |
|
HTTPS |
| Asia Pacific (Sydney) | ap-southeast-2 |
|
HTTPS |
| Asia Pacific (Tokyo) | ap-northeast-1 |
|
HTTPS |
| Canada (Central) | ca-central-1 |
|
HTTPS |
| China (Beijing) | cn-north-1 |
|
HTTPS |
| China (Ningxia) | cn-northwest-1 |
|
HTTPS |
| Europe (Frankfurt) | eu-central-1 |
|
HTTPS |
| Europe (Ireland) | eu-west-1 |
|
HTTPS |
| Europe (London) | eu-west-2 |
|
HTTPS |
| Europe (Paris) | eu-west-3 |
|
HTTPS |
| Europe (Stockholm) | eu-north-1 |
|
HTTPS |
| Middle East (Bahrain) | me-south-1 |
|
HTTPS |
| South America (São Paulo) | sa-east-1 |
|
HTTPS |
| AWS GovCloud (US-East) | us-gov-east-1 |
|
HTTPS |
| AWS GovCloud (US-West) | us-gov-west-1 |
|
HTTPS |
Service quotas
The following table provides the default limits for Amazon Elastic Container Registry (Amazon ECR).
| Name | Default | Adjustable | Description |
|---|---|---|---|
| Filters per rule in a replication configuration | Each supported Region: 100 | No | The maximum number of filters per rule in a replication configuration. |
| Images per repository | Each supported Region: 10,000 |
Yes |
The maximum number of images per repository. |
| Layer parts | Each supported Region: 4,200 | No | The maximum number of layer parts. This is only applicable if you are using Amazon ECR API actions directly to initiate multipart uploads for image push operations. |
| Lifecycle policy length | Each supported Region: 30,720 | No | The maximum number of characters in a lifecycle policy. |
| Maximum layer part size | Each supported Region: 10 | No | The maximum size (MiB) of a layer part. This is only applicable if you are using Amazon ECR API actions directly to initiate multipart uploads for image push operations. |
| Maximum layer size | Each supported Region: 52,000 | No | The maximum size (MiB) of a layer. |
| Minimum layer part size | Each supported Region: 5 | No | The minimum size (MiB) of a layer part. This is only applicable if you are using Amazon ECR API actions directly to initiate multipart uploads for image push operations. |
| Pull through cache rules per registry | Each supported Region: 50 | No | The maximum number of pull-through cache rules. |
| Rate of BatchCheckLayerAvailability requests | Each supported Region: 1,000 per second |
Yes |
The maximum number of BatchCheckLayerAvailability requests that you can make per second in the current Region. When an image is pushed to a repository, each image layer is checked to verify if it has been uploaded before. If it has been uploaded, then the image layer is skipped. |
| Rate of BatchGetImage requests | Each supported Region: 2,000 per second |
Yes |
The maximum number of BatchGetImage requests that you can make per second in the current Region. When an image is pulled, the BatchGetImage API is called once to retrieve the image manifest. If you request a quota increase for this API, review your GetDownloadUrlForLayer usage as well. |
| Rate of CompleteLayerUpload requests | Each supported Region: 100 per second |
Yes |
The maximum number of CompleteLayerUpload requests that you can make per second in the current Region. When an image is pushed, the CompleteLayerUpload API is called once per each new image layer to verify that the upload has completed. |
| Rate of GetAuthorizationToken requests | Each supported Region: 500 per second |
Yes |
The maximum number of GetAuthorizationToken requests that you can make per second in the current Region. |
| Rate of GetDownloadUrlForLayer requests | Each supported Region: 3,000 per second |
Yes |
The maximum number of GetDownloadUrlForLayer requests that you can make per second in the current Region. When an image is pulled, the GetDownloadUrlForLayer API is called once per image layer that is not already cached. If you request a quota increase for this API, review your BatchGetImage usage as well. |
| Rate of InitiateLayerUpload requests | Each supported Region: 100 per second |
Yes |
The maximum number of InitiateLayerUpload requests that you can make per second in the current Region. When an image is pushed, the InitiateLayerUpload API is called once per image layer that has not already been uploaded. Whether or not an image layer has been uploaded is determined by the BatchCheckLayerAvailability API action. |
| Rate of PutImage requests | Each supported Region: 10 per second |
Yes |
The maximum number of PutImage requests that you can make per second in the current Region. When an image is pushed and all new image layers have been uploaded, the PutImage API is called once to create or update the image manifest and the tags associated with the image. |
| Rate of UploadLayerPart requests | Each supported Region: 500 per second |
Yes |
The maximum number of UploadLayerPart requests that you can make per second in the current Region. When an image is pushed, each new image layer is uploaded in parts and the UploadLayerPart API is called once per each new image layer part. |
| Rate of image scans | Each supported Region: 1 | No | The maximum number of image scans per image, per 24 hours. |
| Registered repositories | Each supported Region: 10,000 |
Yes |
The maximum number of repositories that you can create in this account in the current Region. |
| Rules per lifecycle policy | Each supported Region: 50 | No | The maximum number of rules in a lifecycle policy |
| Rules per replication configuration | Each supported Region: 10 | No | The maximum number of rules in a replication configuration. |
| Tags per image | Each supported Region: 1,000 | No | The maximum number of tags per image. |
| Unique destinations across all rules in a replication configuration | Each supported Region: 25 | No | The maximum number of unique destinations across all rules in a replication configuration. |
For more information, see Amazon ECR Service Quotas in the Amazon Elastic Container Registry User Guide.
