Skip to main content

Amazon ECR

Amazon ECR (Elastic Container Registry) by Amazon Web Services (AWS) provides a managed container image registry for storing, managing, and deploying Docker container images. You can bring container repository data from Amazon ECR into Brinqa to gain a unified view of your container image supply chain, thus strengthening your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Amazon ECR and how to obtain that information from Amazon. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings​

When setting up a data integration, select Amazon ECR from the Connector dropdown. If you cannot find the connector in the dropdown, make sure that you have installed it first. You must provide the following information to authenticate Amazon ECR with Brinqa:

  • Access key ID and Secret access key: The access keys associated with the AWS account. The account must have the required read-only permissions for the specific AWS service. For additional information, see Create an IAM user for AWS access.

  • Default region: The AWS region for the connector. If not specified, the connector uses the AWS Default Region Provider Chain.

Create an IAM user for AWS access​

For detailed steps on creating an IAM user and obtaining access keys, see the Amazon EC2 connector documentation. Follow the same process, but attach the required ECR permissions (ecr:DescribeRepositories, ecr:GetRepositoryPolicy, ecr:ListTagsForResource) instead of the EC2 permissions.

The connector authenticates using the AWS SDK's credential resolution chain. If an assume-role ARN is configured, the connector assumes that IAM role using the provided credentials. Otherwise, it uses the provided access keys directly, falling back to the AWS Default Credential Provider Chain (environment variables, ~/.aws/credentials, or EC2 instance metadata).

Additional settings​

The Amazon ECR connector contains additional options for specific configuration:

  • Assume role ARN: ARN of an IAM role to assume. Comma-separated to assume multiple roles in the same sync.

  • Session duration: Assume-role session duration in seconds. The default setting is 3600.

  • Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.

  • Parallel requests: The maximum number of parallel API requests. The default setting is 8.

  • Maximum retries: The maximum number of times that the integration attempts to connect to the Amazon ECR API before giving up and reporting a failure. The default setting is 10.

Types of data to retrieve​

The Amazon ECR connector can retrieve the following types of data from the Amazon ECR API:

Table 1: Data retrieved from Amazon ECR

Connector ObjectRequiredMaps to Data Model
EcrRepositoryYesCloud Resource
info

For detailed steps on how to view the data retrieved from Amazon ECR in the Brinqa Platform, see How to view your data.

Attribute mappings​

Expand the section below to view the mappings between the source and the Brinqa data model attributes.

EcrRepository

Table 2: EcrRepository attribute mappings

Source Field NameSDM Attribute
encryptionConfiguration.encryptionTypeAsString()ENCRYPTION_TYPE
encryptionConfiguration.kmsKeyKMS_KEY
getRepositoryPolicy().policyTextREPOSITORY_POLICY
imageScanningConfiguration.scanOnPushSCAN_ON_PUSH
listTagsForResource(...).tagsTAGS
repository.createdAtFIRST_SEEN
repository.imageTagMutabilityAsString()IMAGE_TAG_MUTABILITY
repository.registryIdREGISTRY
repository.registryIdREGISTRY_ID
repository.repositoryArnREPOSITORY_ARN
repository.repositoryArnUID
repository.repositoryNameNAME
repository.repositoryNameREPOSITORY
repository.repositoryNameREPOSITORY_NAME
repository.repositoryUriREPOSITORY_URI
Generated (constant AWS)CLOUD_PROVIDER
Generated (derived from policy text — true when policy contains Principal: "*")IS_PUBLIC
Generated (sync region)REGION
Generated (sync timestamp)LAST_CAPTURED

Operation options​

info

The Amazon ECR connector does not support operation options.

APIs​

The Amazon ECR connector uses the Amazon ECR API. Specifically, it uses the following endpoints:

Table 3: Amazon ECR API endpoints

Connector ObjectAPI Endpoint
EcrRepositoryecr:DescribeRepositories
EcrRepositoryecr:GetRepositoryPolicy
EcrRepositoryecr:ListTagsForResource

Changelog​

The Amazon ECR connector has undergone the following changes:

note

This connector is part of a bundled release with other connectors from the same vendor. If a version shows "No change", it means that the connector version was updated for consistency as part of the bundle, but no functional changes were made to this specific connector. You can update to or skip this version without affecting your existing configuration.

Table 4: Amazon ECR changelog

VersionDescriptionDate Published
3.1.0Initial Integration+ release.June 1st, 2026
Last updated on