A container image can look inexpensive until deployments span three Regions, several AWS accounts, and private subnets. ECR storage is only one cost. Image pushes and pulls, regional copies, cross-Region data transfer, private-subnet routing through a NAT gateway, retained CI artifacts, and security services can increase wider cloud costs.
Amazon ECR pricing is easiest to control when your container registry architecture matches where workloads pull images. Separate ECR charges from NAT Gateway, interface endpoint, AWS KMS, CloudWatch, and inter-Region data-transfer charges. Check 2026 rates on the official AWS pricing pages and Pricing Calculator for your selected Regions.
Key Takeaways
- Amazon ECR pricing includes more than image storage. Model retained layers, pushes and pulls, replication, cross-Region data transfer, and related NAT Gateway, interface endpoint, S3, KMS, and CloudWatch charges separately.
- Keep frequently deployed images near their compute workloads. Use cross-Region replication for steady production demand, while remote pulls generally fit only low-use recovery environments after transfer and cold-start costs are estimated.
- Same-Region ECR pulls by eligible ECS, EKS, Fargate, and Lambda workloads may have no ECR transfer charge, but private-subnet routing can still incur NAT Gateway, interface endpoint, cross-AZ, and other network costs.
- Control storage growth with lifecycle policies, shorter retention for CI artifacts, protected production digests, and selective use of ECR Archive. Validate 2026 Regional rates, Free Tier eligibility, and the complete design in AWS pricing pages and the Pricing Calculator.
The cost map for an ECR registry
Amazon Elastic Container Registry (ECR) bills repository owners for stored image data. In a multi-Region design, teams should model image movement, retrieval routes, and charges beyond ECR itself.
Private repositories and public repositories have different storage, pull, authentication, quota, and data-transfer terms. Don’t apply private-ECR assumptions to the public service.
This cost map separates ECR charges from AWS networking, storage, security, and observability charges. Model data transfer by source and destination rather than treating it as one line item.
| Cost component | Region, billing unit, and pricing note | Charge owner | What drives it |
|---|---|---|---|
| Image storage | Selected ECR Region, GB-month; AWS lists $0.10 per GB-month, checked March 2026; source Region is the repository Region, destination is none | ECR | Retained layers, manifests, tags, and unreferenced images |
| Image pushes, data transfer in | Source build Region or external origin to destination ECR Region, GB; review applicable AWS transfer terms | ECR storage plus AWS transfer, where applicable | Pushed layers, manifests, deduplication, and build location |
| Image pulls, data transfer out | Source ECR Region to destination workload Region or the Internet, GB; eligible same-Region AWS compute may have no transfer charge | ECR service and AWS transfer | Pull frequency, workload location, and whether layers cross Regions |
| Replication and cross-Region traffic | Source ECR Region to destination ECR or workload Region, GB; review current ECR replication and AWS transfer rates | ECR replication and AWS transfer | Replication jobs, remote workload pulls, and image consumption |
| NAT gateway processing | Workload Region, NAT Gateway-hour and GB processed; source and destination depend on the route | AWS networking, not ECR | Private subnet access, gateway count, hours, and bytes processed |
| Interface VPC endpoint hours and bytes | Workload Region, endpoint-hour and GB processed; source is the workload subnet or Availability Zone, destination is the ECR service endpoint | AWS networking, not ECR | Endpoint count, Availability Zones, and traffic volume |
| S3 access | S3 Region, request and GB units; source and destination depend on the direct access path | AWS storage, not ECR | Direct S3 operations for pipeline artifacts, logs, or related workloads |
| Customer-managed KMS keys and requests | Key Region, key-month and request units; source is the calling service or workload, destination is the encrypted ECR Region where relevant | AWS KMS, not base ECR storage | Key count, encryption operations, and repository activity |
| Observability, including CloudWatch | Monitoring Region, metric, log-ingestion, and log-storage units; source is the monitored service or workload | AWS observability, not ECR | Metrics, audit events, logs, retention, and dashboard usage |
The AWS ECR pricing page is the source of record for ECR storage and service terms in the selected Region. Check the live official VPC, KMS, and AWS data-transfer pricing pages too, then use AWS Pricing Calculator before approving the design. AWS Free Tier eligibility and allowances are account- and service-specific, not a blanket waiver for networking or security charges.
Amazon ECR pricing for storage
Storage pricing is predictable, yet poor image retention can turn a small rate into a persistent monthly charge. Your image storage total includes retained layers, manifests, tags, and duplicated regional copies. Model active release images separately from older build output and compliance copies.
ECR Standard storage for deployable images
For private repositories, treat $0.10 per GB-month as a conditional reference only. Use it only if the official 2026 ECR pricing page confirms the rate for the selected Region, and check that page before budgeting a production deployment.
Eligible new customers may receive 500 MB-month of private repository storage during their first 12 months through the AWS Free Tier. Verify current eligibility, account restrictions, how the allowance is measured across Regions, and whether unused capacity expires.
Standard storage fits images that clusters and functions may need immediately. Production releases, current rollback versions, and regularly deployed base images belong here.
A simple monthly estimate is:
ECR Standard storage cost = stored GB-month x selected Regional ECR storage rate
For example, assume 800 GB remains stored for the full month. If the official 2026 ECR pricing page confirms a $0.10 per GB-month rate, the illustrative estimate is $80. This assumes the selected Region uses that rate and storage remains constant all month.
ECR Archive has operational limits
ECR Archive requires restoration before use. Its archive restore documentation currently says restoration can take up to 20 minutes. Confirm the current restore time, minimum storage duration, and retrieval charges in live AWS documentation before publication.
Current terms may set a 90-day minimum storage duration. Deleting an archived image earlier may not avoid that minimum, and lifecycle policies can’t be assumed to bypass it.
ECR Archive is a retention tier, not a cold standby tier for an incident response plan. A rollback image that must start now belongs in Standard storage.
Archive pricing and retrieval charges should be checked in the live ECR pricing page and calculator for the deployment Region. Don’t assume a third-party rate table applies to every AWS Region or account.
Data transfer depends on where the pull happens
Storage charges occur whether an image moves or not. Data transfer begins when the registry and consumer sit in different places, or when private networking uses a billable path. Compressed layers, manifests, and repeated cold pulls of container images determine the bytes that move.
Same-Region ECS, EKS, Fargate, and Lambda pulls
AWS states that eligible same-Region ECR-to-compute data transfer is free at the ECR service level. Its pricing page lists Amazon EC2, Lambda, App Runner, and Fargate among the covered services.
For Amazon ECS, check whether tasks use EC2 or Fargate, then evaluate the network path. Amazon EKS pods running on EC2 in the same Region generally fit the ECR transfer rule. AWS Fargate workloads and AWS Lambda functions can also qualify for same-Region ECR transfer, subject to documented service conditions.
The free result applies only to ECR’s service-level charge. It does not erase NAT gateway processing, interface endpoint usage, cross-AZ routing, or other network-path charges. Any AWS Free Tier allowance also leaves those network-path and cross-Region charges intact.
Cross-Region copies and remote pulls
For cross-Region pulls and replication, data transfer depends on the source and destination Regions, direction, service, and route. For ECR, data transfer in is treated separately from the applicable data transfer out charge and any receiving-side charge. The workload can also incur network-path costs. Verify the exact 2026 AWS wording for each path, rather than assuming both sides always pay the same Internet rates.
Use this model:
Cross-Region transfer cost = GB replicated or remotely pulled x source Regional rate + GB x destination Regional rate
These rates aren’t a universal ECR number. Set both Regions in the calculator and enter the expected monthly bytes. Include every replica destination in the estimate.
Assume one 40 GB image is copied to two additional Regions. That creates two 40 GB destination transfers, or 80 GB total, before future layer updates. Cached layers reduce actual pulls, while fresh nodes, autoscaling, deployments, and cleared caches increase them.
The AWS guide to container data transfer costs is useful when a deployment combines ECR with ECS, EKS, Fargate, load balancers, and private networking.
Choose among single-Region, replicated, and pull-based designs
The lowest-cost arrangement isn’t always the right operational choice. Recovery objectives, release frequency, local startup time, and compliance boundaries matter as much as the ECR bill.
Public ECR and private ECR have different pricing and usage assumptions. Separate ECR storage and transfer from NAT Gateway, VPC endpoint, inter-Region transfer, and compute charges.
Keep a single authoritative Region
A single registry Region works well for development platforms, internal tools, and workloads concentrated near one compute Region. Same-Region pulls avoid ECR transfer charges, and storage exists only once.
Image pushes and retained layers stay concentrated in the source Region. NAT Gateway, VPC endpoint, inter-Region transfer, and compute charges remain separate from that ECR bill.
However, workloads in another Region pay cross-Region transfer when they pull from that source. Startup also depends on the network path between Regions. This pattern is weak for high-frequency scaling outside the registry Region.
Use cross-region replication for local registries
Cross-Region replication creates a local copy near each deployment environment. Each destination stores its own image data, so image storage and retained GB-months increase with every replica. Initial copies and new pushed layers create data transfer out from the source Region under AWS’s published rules.
In return, a service in each Region can pull locally without an ECR cross-Region transfer charge. Replication doesn’t remove NAT Gateway, VPC endpoint, inter-Region, or compute charges, which depend on each deployment path. It’s usually the cleaner choice for steady production traffic, regulated geography, or regional failover.
Pull remotely only when demand is low
A pull-based design keeps storage in one Region and has remote workloads retrieve images from it. It avoids replica storage, but each remote pull crosses Regions and can incur ECR transfer charges.
This can fit an infrequently used disaster recovery environment. Remote cold pulls can also add NAT Gateway, VPC endpoint, inter-Region, and compute costs. The pattern becomes expensive and operationally fragile when nodes start often, image layers are large, or autoscaling events create repeated pulls.
The preferred design depends on pull frequency, image size, RTO/RPO, compliance requirements, and Region pricing.
| Architecture | Best fit | Main cost exposure | Operational trade-off |
|---|---|---|---|
| Single Region | One primary compute Region | Storage, data transfer, and local networking | Remote recovery is slower |
| Replicated registry | Steady multi-Region production use | Cross-region replication stores a copy at each destination, plus replication transfer | More policies and repositories to govern |
| Remote pull | Rare secondary Region use | Repeated cross-Region pulls and cold-start compute | Startup depends on another Region |
Stop NAT Gateway charges on image pulls
A same-Region image pull can still cross a NAT Gateway when nodes or tasks run in private subnets without private ECR access. ECR may charge $0 for same-Region data transfer, but network processing can still create charges.
AWS bills the NAT service by provisioned hour and GB processed. If the Amazon VPC pricing page still displays $0.045 per NAT Gateway-hour and $0.045 per GB processed for the referenced Region, use those figures only as illustrative values. Rates vary by Region. Eligible ECR allowances in the AWS Free Tier don’t waive NAT processing or interface endpoint charges.
Assuming a rolling deployment downloads 250 GB through that path each month, processing would add $11.25 at the assumed $0.045 per GB rate. Hourly charges remain separate. In Cost Explorer, separate NAT Gateway and PrivateLink line items from ECR service charges.
Build the private endpoint path correctly
A private VPC endpoint path keeps image pulls off the public route and reduces avoidable processing charges. Private ECR access normally requires interface endpoints for ecr.api and ecr.dkr. The ecr.api VPC endpoint handles API calls, while ecr.dkr handles registry access.
Private ECR image-layer downloads use Amazon S3. Workloads therefore need an S3 gateway endpoint or another permitted S3 route.
Enable private DNS for the interface endpoints. Then permit workload security groups to reach endpoint security groups over HTTPS. Endpoint policies should allow only required ECR and S3 actions, repositories, or accounts where practical.
Gateway endpoints have no hourly or data-processing charge according to AWS VPC pricing. Interface endpoints carry Regional hourly and per-GB charges, usually per Availability Zone.
Verify current interface rates, gateway endpoint treatment, and Regional differences on that page. Compare the VPC endpoint cost with the network traffic it replaces.
Avoid partial endpoint deployments
An ECR interface endpoint without the S3 gateway endpoint can leave layer traffic on the NAT route. Likewise, deploying endpoints in only one Availability Zone can create cross-AZ traffic or availability gaps.
Test a fresh pull from every node group, Fargate subnet, and Region. VPC Flow Logs, gateway metrics, endpoint metrics, and cost allocation data should all show whether bytes still reach NAT.
Estimate a monthly multi-Region ECR bill
A useful forecast starts with measurable image and deployment behavior. Pricing examples can show the method, but they aren’t universal prices. Avoid multiplying the compressed image size by every pod. A node can reuse cached layers, while a fresh node, new task, or cleared cache may pull them again.
Use two cost subtotals
Estimate each Region separately, then total the ECR and related-infrastructure costs. Separate data transfer from direct ECR charges:
ECR subtotal = ECR Standard image storage + ECR Archive storage or retrieval + repository operations + documented ECR transfer items
Related-infrastructure subtotal = NAT Gateway hours and processing + interface endpoint fees + S3 charges + KMS charges + CloudWatch charges + inter-Region data-transfer charges
KMS key and request fees, CloudWatch metrics or log charges, gateway hours and processing, and interface endpoint fees aren’t ECR charges. For a replicated design, add storage for every destination repository. For a remote-pull model, estimate the number of cold pulls and downloaded GB in each consumer Region.
Use a 30-day deployment history rather than a single release day. Include CI pushes, promotion copies, ephemeral environment images, rollback tags, failed build artifacts, and lifecycle policies.
For a three-Region example, assume 180 GB retained in each Region after retention. Each release adds 2 GB of compressed layers, with 40 monthly pushes and two replica destinations. Estimate 10, 12, and 8 cold pulls in Regions 1, 2, and 3, with 70% cache reuse. Also assume 300 GB of NAT-processed traffic, two interface endpoints per Availability Zone in each Region, two customer-managed keys, 20,000 KMS requests, and 5 GB of CloudWatch logs with 100,000 metrics. After checking the AWS Pricing Calculator, apply current official rates for the selected Regions only. Treat the result as an illustration, not a universal price.
A practical estimation sequence
- Export repository storage totals, identify retained GB in each Region, and record lifecycle policies.
- List source and destination Regions for every replication rule and remote pull. Measure data transfer out bytes by source and destination Region.
- Measure monthly image bytes crossing a NAT gateway from private subnets, not only total NAT traffic.
- Count interface endpoints by Region and Availability Zone, record S3 usage, then apply current endpoint prices.
- Add AWS KMS key and request costs if repositories use customer-managed keys.
- Record CloudWatch metric and log usage alongside the image and repository totals.
- Model AWS Free Tier allowances separately. They don’t cover unrelated network or security services. Then compare the estimate with Cost Explorer and actual usage after the first production month.
AWS bills storage over time, so a repository that grows steadily doesn’t equal its end-of-month size multiplied by the full rate. Use daily or hourly storage measurements when repositories grow during the month, rather than applying the full rate to the ending balance.
Control CI/CD image growth before it becomes storage debt
Most registry waste comes from routine pipeline behavior. Every commit may produce a new image, while untagged layers and branch-build artifacts create persistent image storage debt.
Set retention by deployment role
Keep a defined number of production releases and a smaller rollback window. Retain only current images for temporary environments. Separate release repositories from branch-build repositories when retention needs differ.
Lifecycle policies should delete untagged images after a short grace period and expire old build tags on schedule. Protect release references with immutable image digests, a distinct naming pattern, and a longer retention window. Keep mutable build tags on shorter schedules.
Don’t move every old image to ECR Archive. Images with no legal, audit, or recovery purpose should be deleted. Use ECR Archive for retained evidence, approved releases, and long-term reference images.
For base images, a pull-through cache can reduce repeated upstream pulls. It still creates storage for cached images and isn’t free replication.
Verify AWS’s current 2026 Basic and Enhanced scanning terminology and pricing before forecasting these costs. Image scanning findings and continuous monitoring are separate from ECR storage and transfer charges. Amazon Inspector charges, where applicable, may also apply depending on the service and configuration.
Attribute costs by account and repository purpose
A central platform account can hide who created the storage. Track repository owners, environment, product, cost center, and retention class in your internal inventory and AWS tagging model.
Review the largest repositories monthly. Then compare storage growth with build frequency and tag counts. A sharp increase often points to a new pipeline, a disabled lifecycle policy, or repeated promotion into several Regions.
Encryption and account design add smaller charges
ECR provides encryption at rest by default for image data. A customer-managed AWS KMS key can create separate key-month and API-request charges, which aren’t included in the ECR storage rate.
For 2026 estimates, the AWS KMS pricing page lists current key-month and request rates by Region, key type, and request tier. Include the account and hourly prorating assumptions in your forecast.
Use customer-managed keys for a stated requirement
Customer-managed keys may suit private repositories that need key separation, external key controls, or defined access policies. They also require key-policy maintenance across accounts and Regions.
For a multi-Region registry, map repository ownership, account boundaries, replication permissions, and cross-account pulls. Record the KMS key, key-policy administration, and recovery procedure for each Region. A multi-Region key doesn’t remove per-Region pricing or policy work.
A cost-aware operating model for platform teams
Start with one canonical build Region for your container registry. Push signed, approved production images there, and replicate only to Regions with frequent or latency-sensitive production pulls.
Use local registry copies for active workloads across several Regions. They trade additional storage and replication traffic for predictable local pulls. Keep remote pulls for low-use recovery environments only after modeling cold-start bytes and transfer rates. Review whether cached images, node scaling patterns, and deployment frequency still support that decision.
Private workloads should use ECR API and registry interface endpoints, plus S3 access through a VPC endpoint. Compare current endpoint costs with gateway hours and processing before changing the design. Monitor NAT Gateway, endpoint, CloudWatch, and inter-Region transfer line items independently. Recheck the comparison whenever image sizes, cluster count, or Availability Zone coverage changes to support ongoing cost optimization.
Final thoughts
Amazon ECR pricing depends on more than storage. Model retained image data, image pushes and pulls, replication, cross-Region data transfer, NAT Gateway processing, interface endpoints, AWS KMS, CloudWatch, and other networking charges separately.
A cost-aware design keeps active production images near compute and uses retention controls to limit growth. Validate those assumptions with official 2026 AWS pricing pages and the Pricing Calculator before committing to a multi-Region design.
Frequently asked questions
How much does ECR charge for standard private image storage?
For eligible private repositories, AWS lists ECR Standard storage at $0.10 per GB-month as of September 2026. This is a reference rate for the selected Region and account, so confirm eligibility on the live AWS pricing page before budgeting.
Eligible new AWS customers receive 500 MB per month of private storage for the first year through the AWS Free Tier. The allowance is calculated monthly across Regions, but it doesn’t cover inter-Region transfer, interface endpoint fees, gateway processing, AWS KMS key and request charges, or CloudWatch charges.
Are pulls from ECR by AWS Fargate and Amazon ECS free in the same Region?
Yes. AWS states that data transfer between ECR, AWS Fargate, and Amazon ECS in the same Region is free. This covers ECR transfer, not every network or observability cost.
Interface endpoint fees, gateway processing, inter-Region transfer, AWS KMS key and request charges, and CloudWatch charges remain separate. A private-subnet task can therefore incur network costs even when its ECR transfer is free.
Why did image pulls create a large NAT gateway bill?
Private ECS, EKS, or Fargate workloads may reach ECR through a NAT gateway when no private endpoint path exists. The NAT gateway bills by hour and GB processed, so frequent cold pulls of large images can create a material charge.
That charge is separate from ECR storage and transfer. Interface endpoint fees, inter-Region data transfer, AWS KMS key and request charges, and CloudWatch charges can also apply.
Use ECR API and registry interface endpoints with an S3 gateway endpoint, then verify the route with flow and endpoint metrics. Endpoint hourly and processing fees still apply.
Should every Region receive a replicated ECR repository?
No. Replicate to Regions where workloads pull images regularly, recovery objectives require local availability, or data residency rules apply. A replica is preferable when remote-pull latency, recovery risk, or cross-Region transfer costs outweigh added storage.
An idle recovery Region may cost less with remote pulling. That choice changes when recovery tests, autoscaling, or image size increase.
Replication storage and inter-Region transfer are separate ECR-related costs. Endpoint fees, gateway processing, AWS KMS key and request charges, and CloudWatch charges remain outside the repository estimate.
What happens when an archived ECR image is needed?
Archived images in ECR Archive must be restored before use. AWS says restoration can take up to 20 minutes, and archived images have a 90-day minimum storage duration.
Keep images required for immediate rollback or rapid scale-out in Standard storage. Check current archive storage and retrieval pricing for the selected Region in AWS’s pricing tools.
Archive storage and restore charges are separate from interface endpoint fees, gateway processing, inter-Region transfer, AWS KMS key and request charges, and CloudWatch charges.
