Question: How do I allow Amazon ECS tasks to pull images from an Amazon ECR image repository?

How do I allow Amazon Elastic Container Service (Amazon ECS) tasks to pull images from an Amazon Elastic Container Registry (Amazon ECR) image repository?Short descriptionTo access the Amazon ECR image repository with your launch type, choose one of these options:For Amazon Elastic Compute Cloud (Amazon EC2) launch types, you must provide permissions to ecsTaskExecutionRole or the instance profile associated with the container instance. However, it's always a best practice to provide Amazon ECR permissions to ecsTaskExecutionRole. If permissions are provided to both the instance and the role, then ecsTaskExecutionRole takes precedence.For AWS Fargate launch types, you must grant your Amazon ECS task execution role permission to access the Amazon ECR image repository.

ResolutionFor EC2 launch typesOpen the AWS Identity and Access Management (IAM) console.In the navigation pane, choose Roles, and then choose Create role.Choose the AWS service role type.In the Use Case section, select EC2. Then, select Next.Choose the default AmazonEC2ContainerServiceforEC2Role managed policy, and then choose Next.Note: The AmazonEC2ContainerServiceforEC2Role policy also allows you to register container instances to your ECS cluster and enable log streams in Amazon CloudWatch.Add tags to your policy, if desired, and then choose Next.For Role name, enter a unique name (such as ECSRoleforEC2), and then choose Create role.Launch a new container instance using the latest Amazon ECS-optimized Amazon Linux AMI.Attach the role that you created to the new container instance.Create a task definition.Important: In the containerDefinitions section of your task definition, specify the ECR image aws_account_id.dkr.ecr.region.amazonaws.com/repository:tag as the image property.Run a task or a service using the task definition that you created in step 10.(Optional) If you don't want to provide permissions to an instance profile, give permissions to the ECS Task Execution Role. Then, run a task or a service using the task definition that you created in step 10.For Fargate launch typesAn Amazon ECS task execution role is automatically created in the Amazon ECS console first-run experience. If you can't find the role or the role is deleted, complete these steps:Open the IAM console.In the navigation pane, choose Roles, and then choose Create role.In the Select type of trusted entity section, choose Elastic Container Service.For Select your use case, choose Elastic Container Service Task, and then choose Next.In the Attach permissions policy section, search for AmazonECSTaskExecutionRolePolicy, select the policy, and then choose Next.Note: This policy also provides permissions to use the awslogs log driver.For the Role Name, enter ecsTaskExecutionRole, and then choose Create role.Create a task definition.Important: In the containerDefinitions section of your task definition, specify the ECR image aws_account_id.dkr.ecr.region.amazonaws.com/repository:tag as the image property. Specify the IAM role created in step 6.Run a task or a service using the task definition that you created in step 7.Your task or service can now pull images from the Amazon ECR image repository.

Related informationUsing Amazon ECR Images with Amazon ECS