Registry Namespaces

5 minutes 5 Questions

Amazon ECR Registry Namespaces allow you to organize and categorize your container images by logically grouping them under a designated name. By taking advantage of namespaces, you can more effectively manage and control access to specific container images on a granular level. The namespaces aid in providing a clear structure to your repository and make it easier to manage permissions and apply access controls for different teams, applications, or environments, all within a single ECR registry. This feature is essential in implementing a multi-tenant architecture, ensuring the images are organized and securely accessible to the appropriate users.

Guide: AWS Solutions Architect - Amazon ECR: Registry Namespaces

Amazon ECR (Elastic Container Registry) is a fully managed registry service provided by AWS. One of its key concepts is the 'Registry Namespaces'.

What is a Registry Namespace?
The Registry Namespace is essentially a container for your Docker images. It's a way of grouping these images coherently so that you can better manage accessibility and workflow within your development and production environments. Each AWS account is provided with a unique registry namespace.

Why is it important?
Registry Namespaces are critical in helping you manage and govern access to your Docker images, avoiding potential conflicts between different environments or projects.

How does it work?
Images in an ECR repository are specified using both the registry and repository names (registry/repository:tag). Upon creation of an ECR repository within your namespace, you will be provided with a registry URI (account-id.dkr.ecr.region.amazonaws.com/repository-name).

Exam Tips: Answering Questions on Registry Namespaces
- Remember the format registry/repository:tag when asked to identify or construct ECR repository URIs.
- Understanding that Registry Namespace aids in managing images and handling permissions might come up in scenario-based questions.
- Know that each AWS account will have a unique Registry Namespace. This can be a trick question in the exam.

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

Question 1

You need to delete an image from ECR, but are unable to do so. What could be the possible reason?

The image is referenced by 'latest' tag. The repository is in multi-region mode. The image is currently being pulled by another service. Your IAM role does not allow you to delete images in ECR.

Correct Answer: The image is referenced by 'latest' tag.

If you are unable to delete an image, the possible reason is that the image is being referenced by the 'latest' tag. Other alternatives are either incorrect due to the fact that they do not stop you from deleting an image or are not possible.

Question 2

A team uses Docker Hub but wants to migrate their docker images to Amazon ECR. What action should you take to move to ECR?

Create an IAM Role to connect to Docker Hub. Manually copy the repository structure into S3. Transfer the images using AWS Lambda. Create a new repository in ECR and 'docker push' the images to ECR.

Correct Answer: Create a new repository in ECR and 'docker push' the images to ECR.

To migrate from Docker Hub to Amazon ECR, you should create a new repository in ECR and use 'docker push' to push the images. Other alternatives are incorrect because they are either invalid or not suited for the task.

Question 3

Which policy should be applied to the repository to allow users from another AWS account to pull container images?

Grant public access to each image. Add an IAM role with cross-account access to the repository. Create an EC2 instance with temporary access keys for the other account. Add a repository policy granting 'ecr:GetDownloadUrlForLayer', 'ecr:BatchGetImage', and 'ecr:BatchCheckLayerAvailability' permissions.

Correct Answer: Add a repository policy granting 'ecr:GetDownloadUrlForLayer', 'ecr:BatchGetImage', and 'ecr:BatchCheckLayerAvailability' permissions.

To allow users from another AWS account to pull images, you need to add a repository policy granting 'ecr:GetDownloadUrlForLayer', 'ecr:BatchGetImage', and 'ecr:BatchCheckLayerAvailability' permissions. The other alternatives are either inappropriate, insecure, or not achievable.

Go Premium