Back to Amazon EC2 Container Registry

Amazon ECR Public

5 minutes 5 Questions

Amazon ECR Public enables you to store, manage, and deploy public container images to share with other AWS users, or for use within your own development workflows. You can host and manage any number of public images, making it easier to share and distribute your software to users globally. Addition…

Test mode:
Start practice test
AWS Certified Solutions Architect - Amazon ECR Public Example Questions

Test your knowledge of Amazon ECR Public

Question 1

An organization publishes container images to an Amazon ECR Public repository. A critical vulnerability is found in image tag v1.2.3 used by the production deployment pipeline. The security team requires that no clients, including anonymous users, be able to pull this vulnerable image from ECR Public going forward. What single action should be taken to immediately prevent any new pulls of this image?

Correct Answer: Delete the vulnerable image from the ECR Public repository

For an Amazon ECR Public repository, images are accessible to any client (including anonymous users) unless removed. To ensure the vulnerable image cannot be used going forward, you must delete the image manifest (and associated tags) from the ECR Public repository. This immediately prevents any new pulls of that image by tag or digest. Enabling encryption does not restrict reads; AWS Shield is unrelated to image access; and changing IAM policies for specific users does not prevent anonymous or other external clients from pulling from a public repository. Note that deleting the image does not affect containers that are already running or copies already pulled elsewhere.

Question 2

A company uses Amazon ECR Public to publish container images. Images must remain publicly pullable, but only the owning team should be able to create, update, or delete images in their repositories. The company will manage all teams in a single AWS account. How should the company enforce this access control?

Correct Answer: Use IAM identity policies scoped to each team's Amazon ECR Public repository ARNs so that only that team's roles/users can push and manage images in their repositories.

In Amazon ECR Public, image pulls are intentionally public, but publishing and managing repositories are controlled via authorization. The correct approach is to grant least-privilege IAM permissions for each team, scoping allowed actions (for example, ecr-public:BatchCheckLayerAvailability, InitiateLayerUpload, UploadLayerPart, CompleteLayerUpload, PutImage, and repository management actions) to the specific repository ARNs owned by that team. This ensures only the owning team can create, update, or delete images in their repositories while images remain publicly pullable. Encryption does not enforce authorization, API Gateway is not part of ECR access control, and creating separate AWS accounts is unnecessary given the requirement to manage all teams in a single account.

Question 3

A developer wants to use Amazon ECR Public to manage their Docker container images. What is the appropriate way to push and pull container images to and from the ECR Public repository?

Correct Answer: Use the Docker CLI with appropriate ECR Public commands

The Docker CLI with appropriate ECR Public commands is the standard and recommended way to push and pull container images to and from Amazon ECR Public repositories. All the other options are either not recommended or not feasible for managing Docker images.

More Amazon ECR Public questions
18 questions (total)
Start 18 question test