Amazon ECR

Amazon Web Services

Overview

Integrates with Amazon Elastic Container Registry (ECR) to inventory the private container-image repositories across the configured AWS accounts and regions. For each repository the connector reads its configuration (image tag mutability, scan-on-push, encryption type and KMS key) and its exposure surface — the resource-based repository policy — so downstream analysis can flag publicly pullable repositories. The connector enumerates repositories region by region via the ECR DescribeRepositories API and emits one Brinqa object per repository.

Data retrieved from Amazon ECR

Connector Object	Required	Maps to Data Model
EcrRepository	Yes	Cloud Resource

note

For detailed steps on how to view the data retrieved from Amazon ECR in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Amazon ECR from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Access key ID	No	—	AWS user access key ID, if not specified, the connector consults the default credentials provider chain to try and determine the \
Secret access key	No	—	AWS user secret access key, if not specified, the connector consults the default credentials provider chain to try and determine the \
Default region	No	us-east-1	Default AWS region, if not specified, the connector consults the default region provider chain to try and determine the region to use.
Assume role	No	— (empty)	Amazon Resource Name for the role to assume.
Session duration	No	900	Assume role session duration in seconds.
Page size	No	100	The maximum number of results to retrieve per operation.

Authentication

Authentication is shared across the AWS connector bundle via the AwsConfiguration base class. The ECR sub-connector uses the AWS SDK for Java v2 EcrClient, which signs every request with AWS SigV4 using credentials resolved through the following chain (in order):

1. STS AssumeRole — if assumeRoleARN is configured, the connector assumes that role (using the credentials below as the principal) and uses the resulting temporary session credentials.
2. Static access keys — if accessKey / secretKey are configured, they are used directly.
3. Default credentials provider chain — environment variables, ~/.aws/credentials, container role, or EC2 instance metadata.

Assumed-role sessions use the configurable sessionDuration (default 900 s) with a unique session name per sync. assumeRoleARN may be a comma-separated list to sync multiple accounts in one run. An EcrClient is constructed per role per region; each client is closed once its region has been fully synced.

Required AWS API permissions

Permission	Purpose
ec2:DescribeRegions	Enumerate the regions to sync when no explicit region/regions option is supplied
ecr:DescribeRepositories	List and page through repositories in each region
ecr:GetRepositoryPolicy	Read the repository resource policy (public-access detection)
ecr:ListTagsForResource	Read repository tags
sts:AssumeRole	Only when assumeRoleARN is set

How to obtain Amazon ECR credentials

Create an IAM user for AWS access

For detailed steps on creating an IAM user and obtaining access keys, see the Amazon EC2 connector documentation. Follow the same process, but attach the required ECR permissions (ecr:DescribeRepositories, ecr:GetRepositoryPolicy, ecr:ListTagsForResource) instead of the EC2 permissions.

The connector authenticates using the AWS SDK's credential resolution chain. If an assume-role ARN is configured, the connector assumes that IAM role using the provided credentials. Otherwise, it uses the provided access keys directly, falling back to the AWS Default Credential Provider Chain (environment variables, ~/.aws/credentials, or EC2 instance metadata).

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

EcrRepository

Source Field Name	SDM Attribute
constant AWS	CLOUD_PROVIDER
derived — see below	IS_PUBLIC
GetRepositoryPolicyResponse.policyText	REPOSITORY_POLICY
ListTagsForResourceResponse.tags	TAGS (multivalued)
Repository.createdAt	FIRST_SEEN
Repository.encryptionConfiguration().encryptionTypeAsString()	ENCRYPTION_TYPE
Repository.encryptionConfiguration().kmsKey	KMS_KEY
Repository.imageScanningConfiguration().scanOnPush	SCAN_ON_PUSH
Repository.imageTagMutabilityAsString()	IMAGE_TAG_MUTABILITY
Repository.registryId	REGISTRY_ID
Repository.registryId	REGISTRY
Repository.repositoryArn	UID
Repository.repositoryArn	REPOSITORY_ARN
Repository.repositoryName	REPOSITORY_NAME
Repository.repositoryName	REPOSITORY
Repository.repositoryName (falls back to repositoryArn)	NAME
Repository.repositoryUri	REPOSITORY_URI
sync region	REGION
sync timestamp (Instant.now())	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

EcrRepository

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query (one client per region).	All regions from ec2:DescribeRegions
maxResults	Page size for each DescribeRepositories call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 (EcrClient) · Endpoint: ecr:DescribeRepositories

Changelog

Changelog

The Amazon ECR connector has undergone the following changes:

Version	Description	Migration Steps
3.2.1	No changes in this release.	N/A
3.2.0	No changes in this release.	N/A
3.1.0	New Features - New connector — syncs container repositories. Repositories include a derived flag indicating public access. Improvements - Sync failures are now visible. Previously, certain AWS API errors (throttling, server errors, transient network failures, validation errors) could be silently swallowed during multi-region sync, producing empty results without indicating a problem. These now surface as sync failures with a clear log entry detailing the HTTP status, AWS error code, request id, and service name. Per-region permission gaps (HTTP 401 / 403) still allow the sync to continue across other regions, but are now visible in logs.	N/A