Configure an Amazon ECR pull-through cache rule to automatically sync images between two ECR private registries across AWS accounts

domain: docs.aws.amazon.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. In the destination AWS account, create a pull-through cache rule targeting the source ECR registry using aws ecr create-pull-through-cache-rule --ecr-repository-prefix <PREFIX> --upstream-registry-url <SOURCE_ACCOUNT_ID>.dkr.ecr.<REGION>.amazonaws.com
  2. In the source ECR registry, create a registry policy (aws ecr put-registry-policy) that grants the destination account ecr:BatchGetImage and ecr:GetDownloadUrlForLayer permissions
  3. In the destination account, create an IAM role or attach an inline policy to the ECR service that permits ecr:CreateRepository and ecr:BatchImportUpstreamImage on the destination registry
  4. Trigger a cache pull by running docker pull <DESTINATION_ACCOUNT_ID>.dkr.ecr.<REGION>.amazonaws.com/<PREFIX>/<IMAGE>:<TAG>; ECR will fetch the image from the source and cache it automatically
  5. Verify the cached image exists in the destination registry using aws ecr describe-images --repository-name <PREFIX>/<IMAGE>

Known gotchas

Related routes

Apply a lifecycle policy to AWS ECR repositories created automatically by pull-through cache rules using a repository creation template
docs.aws.amazon.com · 5 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans