ECR pricing: storage is 13% of it (2026)

Amazon ECR storage costs $0.10 per GB-month in AWS's own worked examples, and pulling those images to EC2, Fargate or Lambda in the same Region costs nothing at all. The registry does not charge for the traffic. On a hypothetical CI pipeline priced below from AWS's published rates, storage is 13.5% of what the registry really costs, vulnerability scanning is 56.5%, and the network path the pulls travel is the other 30%. Neither of those last two lands on the Amazon ECR line of the bill.

How much does Amazon ECR storage cost per GB?

$0.10 per GB-month for a private repository, in US East. The rate tables on the Amazon ECR pricing page are rendered in JavaScript, but Pricing Example 1 states the number outright: "You are charged for storage at $0.10 per GB for a total of $4/month, but charged nothing for data transfer in." The free tier is thin. A new account gets "you get 500 MB per month of storage for your private repositories for one year", half of one modest image, and "free usage does not accumulate". Public repositories get a permanent allowance instead, "50 GB per month of always-free storage".

Is Amazon ECR free to pull images from in the same Region?

Yes, and the pricing page says so without qualification. Under Pricing Examples: "Data transferred between Amazon ECR and other services within the same Region" ... "is free of charge (i.e., $0.00 per GB)". Example 1 applies it to real volume: a team pulls 1 TB a month with ECS on EC2 or Fargate, and "so they are not charged for data transfer out". That example's whole bill is the $4 of storage.

Note what the sentence does not do: carve out Availability Zones. No page we read documents a per-AZ charge for an ECR pull, which puts ECR alongside S3 and DynamoDB, free to reach from EC2 in the Region as long as nothing chargeable sits in the path. That last clause is the whole post; the mechanics are in cross-AZ data transfer cost.

Cross-Region is a different bill. Example 2 pulls 50 GB into us-west-1, where "The data transfer out is charged at $0.09 per GB for a total data transfer out charge of $4.50." The ECR FAQ states the rule plainly: "Pulling images between Regions or out to the internet will have additional latency and data transfer costs." Replication bills the same way, "Data transferred when copying images across regions using Cross Region Replication incur ECR data transfer out charges". Budget one side of it: the page's footnote says "on both sides of the transfer", and its own Example 2 charges exactly one.

What does pulling an ECR image through a NAT Gateway cost?

$0.045 per GB, on top of the $0.00 ECR charges for the same bytes. A private subnet with no endpoints reaches ECR through a NAT Gateway, and the VPC pricing page is blunt about what that meters: "Data processing charges apply for each gigabyte processed through the NAT gateway regardless of the traffic’s source or destination." Its worked example puts the rate at "$0.045 per hour" for the gateway and $0.045 per gigabyte processed. A hypothetical on AWS's rates and AWS's 720-hour month: a CI pipeline pulls a 500 MB image 200 times a day, 3,000 GB a month.

The NAT path costs $167.40 a month to move bytes the registry gives away; the endpoint path costs $43.20. If the NAT Gateway sits in a different zone from the instances pulling, add more: "There will be data transfer charges between your NAT gateway and EC2 instance if they are in a different Availability Zone." At the $0.010 per GB regional rate shown as a CUR line item in the AWS Networking blog on VPC peering charges, that is $30.00 more on 3,000 GB, one direction. The gateway's other meters are in what a NAT Gateway costs.

Do you need a VPC endpoint for Amazon ECR, and what does one cost?

You need three, and only two are billed. The ECR VPC endpoints guide says "Amazon ECS tasks hosted on Amazon EC2 instances require both Amazon ECR endpoints and the Amazon S3 gateway endpoint": ecr.dkr for push and pull, ecr.api for API calls, and a third where the money is, because "The gateway endpoint is required because Amazon ECR uses Amazon S3 to store your image layers." Interface endpoints charge per ENI-hour and per gigabyte: the PrivateLink pricing page says "You will be billed for each hour that your VPC endpoint remains provisioned in each Availability Zone", at "$0.01 per hour for each endpoint ENI". Gateway endpoints charge nothing: "There are no data processing or hourly charges for using Gateway Type VPC endpoints."

So the split decides the bill. "When your containers download images from Amazon ECR, they must access Amazon ECR to get the image manifest and then Amazon S3 to download the actual image layers." Manifests and API calls go over the metered interface endpoints; the layers, nearly all of the bytes, go over the free gateway endpoint. Two ECR interface endpoints across three zones is six ENIs, $43.20 a month, and the per-GB charge lands on a rounding error instead of on your image traffic. Endpoint economics in general are in what VPC endpoints actually cost.

That is a break-even AWS does not publish. Against a single NAT Gateway the endpoint set costs $10.80 a month more before any data moves, and the NAT's $0.045 per GB erases that at 240 GB. Above roughly 240 GB of pulls a month the endpoints win; against a NAT Gateway per zone, they win at zero.

How much does Amazon ECR image scanning cost?

Nothing from ECR, and up to $0.24 per image per month from Amazon Inspector. The enhanced scanning page is explicit about which service bills: "There is no additional cost from Amazon ECR to use this feature, however there is a cost from Amazon Inspector to scan your images." The ECR pricing page carries no scanning line at all.

Inspector hides its tables in JavaScript too, so its rates come from the worked examples on the Amazon Inspector pricing page. Example 2: "1,000 newly pushed container images initially scanned at $0.09 each" and "1,500 images, each rescanned an average of 15 times, at $0.01 per rescan". Example 7 prices scans inside a build: "1,000 container images within CI/CD tools, at $0.03 each = $30.00".

That third column is the finding. Scanning a 500 MB image on push and rescanning it fifteen times costs $0.24; storing it costs $0.05. Scanning is 4.8 times the storage charge, and it scales with how often you push, not with how much you keep.

Basic scanning is rate-limited rather than priced. The basic scanning page says "An image can be scanned once per 24 hours", and the ECR service quotas carry that as a hard quota of 1. One detail decides what enhanced scanning costs in its first month: turning it on skips the backlog, because "Amazon Inspector only recognizes images pushed to Amazon ECR in the last 14 days" at that moment. Per-resource security billing of this shape is also how Security Hub prices container images.

What does a busy CI pipeline actually pay for Amazon ECR?

Hypothetical, priced from the AWS rates above. A team pushes 1,000 images a month at 500 MB each, retains 1,500, runs continuous enhanced scanning and pulls 3,000 GB through a NAT Gateway in one zone.

Only $75 of that appears on the Amazon ECR line. The other $482.40 is booked to Amazon Inspector and Amazon VPC, which is why a registry with an unremarkable ECR line can still be expensive. Swapping the NAT path for endpoints takes $124.20 off; moving from continuous rescanning to scan-on-push takes $225.00 off; deleting half the images saves $37.50. Chasing the biggest number rather than the most familiar one is the habit described in EC2 - Other in Cost Explorer.

Is Amazon ECR Public free, and what are its limits?

Mostly, and the limits are stated in two places that do not agree. The pricing page reads as a free tier: "You can anonymously (without using an AWS account) transfer 500 GB of data to the Internet from a public repository each month for free", rising to 5 TB with an account, and "You also get unlimited bandwidth at no cost when transferring data from a public repository to AWS compute resources in any AWS Region." The ECR Public service quotas page describes the same 500 GB as a ceiling instead: "For unauthenticated customers, Amazon ECR Public supports up to 500GB of data per month. This is the max amount of data supported and isn't adjustable." One page puts it where billing starts, the other where service stops. Plan for the quota reading, because the pricing page has no anonymous tier above 500 GB to bill into. Note too that authenticating a public pull costs nothing and buys ten times the pull rate.

Do Amazon ECR pull through cache rules cost anything?

Not as a rule, but a cache is a repository and repositories are billed. The pull through cache page states the accounting in one sentence: "Amazon ECR repositories created using the pull through cache workflow are treated like any other Amazon ECR repository." Every image you cache from Docker Hub or Quay becomes $0.10 per GB-month you were not paying before.

It grows unattended by default: among the settings ECR applies to repositories it creates for you is "Lifecycle policy – Omitted, no lifecycle policy is applied." Multi-architecture tags make it worse, because "the manifest list and each image referenced in the manifest list are pulled to the Amazon ECR repository", so you cache every architecture unless you pull by digest.

Then the contradiction. Two AWS pages agree the first pull through a cache rule needs a route out of the private subnet and disagree on what that route is. The pull through cache page says to create a public subnet "with an internet gateway, and then route all outbound traffic to the internet from their private subnet to the public subnet". The ECR VPC endpoints page, on the same scenario, says to create one "with a NAT gateway, and then route all outbound traffic to the internet from their private subnet to the NAT gateway in order for the pull to work". An internet gateway is free. A NAT Gateway is $32.40 a month plus $0.045 per GB. AWS offers both as the fix for the same first pull and never says the price differs.

How do ECR lifecycle policies and the archive class cut storage cost?

Lifecycle policies are the only storage control ECR gives you, and they are on by default nowhere. The lifecycle policy guide sets the cadence: "Once a lifecycle policy is applied to a repository, you should expect that images become expired within 24 hours after they meet the expiration criteria." Rules count from when an image was pushed, when it was last pulled, or how many the repository holds. Last-pulled matches how a registry accumulates dead tags.

Archiving is the alternative to deleting. Its per-GB rates are in the JavaScript tables, so read them off the pricing page; three conditions are in the static text. "Archive storage is charged for a minimum storage duration of 90 days", the same trap as S3 storage class minimums. Retrieval is charged per GB. And because "You cannot directly pull from images stored in ECR Archive", a restore sits on the critical path of any deploy that needs one, and the ECR archive and restore page sets the expectation: "You can expect ECR to restore the image within 20 minutes." The image scanning page adds the part nobody plans for: "Archived images cannot be scanned. Archived images must be restored before they can be scanned." Archiving to save $0.10 per GB-month also removes the image from your vulnerability posture, which is a compliance decision wearing a cost decision's clothes.

The order of operations is unglamorous. Put the pulls behind an S3 gateway endpoint and the two ECR interface endpoints, decide which repositories really need continuous rescanning, and write the lifecycle policy last, because it is the smallest of the three. For the container cost picture above the registry, see what EKS Auto Mode costs.