Welcome to the second lesson in our course on Working with Container Registries. In the previous lesson, you explored Amazon ECR and verified your environment through the AWS CLI. Now it's time to create your first ECR repository with security best practices built in from day one.

Rather than creating a basic repository and adding security later, you'll learn to configure security settings during initial creation. This lesson focuses on two critical security features: scan on push for automatic vulnerability detection and immutable tags for deployment consistency.

By the end of this lesson, you'll run the aws ecr create-repository command with appropriate security flags and verify your settings using aws ecr describe-repositories.

Security in container registries goes beyond access control — it's about ensuring the integrity and safety of your stored images. Amazon ECR provides built-in security features that you can enable during repository creation.

Scan on push automatically analyzes container images for known security vulnerabilities whenever you push a new image. ECR uses a comprehensive vulnerability database to identify potential issues in image layers, including OS packages and application dependencies. Scans typically complete within minutes and provide severity ratings to help you prioritize fixes.

Immutable tags prevent you from pushing new images with existing tags, protecting against accidental overwrites that could introduce inconsistencies in your deployment pipeline.

Key Benefits:

• Scan on push: Immediate vulnerability feedback for every pushed image
• Immutable tags: Prevents accidental overwrites and maintains deployment consistency
• Automated security: Built-in protection without manual intervention

Consider a real-world scenario: without immutable tags, a developer could accidentally push a broken image with the :latest tag, overwriting a stable version. With immutable tags enabled, this would fail, preserving existing deployments.

Before creating your first ECR repository, understand these key requirements:

Region awareness is crucial because repositories are region-specific. A repository created in us-west-2 won't be accessible from us-east-1. This affects both repository URIs and deployment strategies.

IAM permissions are required for ECR operations. Key permissions include ecr:CreateRepository for creation, ecr:PutImage for pushing, and ecr:GetAuthorizationToken for authentication.

In the CodeSignal environment, these prerequisites are pre-configured with appropriate credentials and regional settings.

The aws ecr create-repository command is your primary tool for creating new ECR repositories. Understanding its key parameters helps you configure repositories correctly from the start, combining basic settings with advanced security features in a single command.

Essential Parameters:

• --repository-name: The repository name (required) - must contain lowercase letters, numbers, hyphens, underscores, and forward slashes only
• --region: Specifies the AWS Region where the repository will be created (e.g., us-west-2). If not specified, it uses the default region configured in your AWS CLI profile.
• --image-scanning-configuration scanOnPush=true: Enables automatic vulnerability scanning
• --image-tag-mutability IMMUTABLE: Prevents tag overwrites (use MUTABLE to allow overwrites)

These flags work together to create a repository that balances usability with security. Scan on push provides immediate vulnerability feedback, while immutable tags prevent deployment inconsistencies.

Create your first secure ECR repository with this command:

aws ecr create-repository \
  --repository-name my-web-app \
  --image-scanning-configuration scanOnPush=true \
  --image-tag-mutability IMMUTABLE

This creates a repository named my-web-app with both vulnerability scanning and immutable tags enabled. The command returns JSON output containing repository details:

{
    "repository": {
        "repositoryUri": "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-web-app",
        "imageTagMutability": "IMMUTABLE",
        "imageScanningConfiguration": {
            "scanOnPush": true
        }
    }
}

The repositoryUri is the complete address you'll use for pushing and pulling images. The output confirms your security settings are configured correctly.

Verify your repository creation using the describe command:

aws ecr describe-repositories

This returns detailed information about all repositories in your current region. Focus on these key fields in the output:

• imageScanningConfiguration.scanOnPush: Should show true
• imageTagMutability: Should show IMMUTABLE
• repositoryUri: Your complete repository address

This verification confirms that your repository exists and security features are properly enabled.

When creating ECR repositories, several common issues can cause confusion or prevent successful repository creation. Understanding these pitfalls and their solutions helps you troubleshoot problems quickly.

Common Issues and Solutions:

• Region mismatch: Use --region flag to specify the correct region
• Access denied: Verify your IAM policies include required ECR permissions
• Name conflicts: Repository names must be unique within your account/region
• Parameter formatting: Use exact formats like scanOnPush=true and IMMUTABLE (case-sensitive)
• Network issues: If commands fail with connection timeouts, verify your network settings. If issues persist, check VPC/DNS settings or confirm you can reach the regional ECR endpoint (e.g., ecr.us-west-2.amazonaws.com).

Most repository creation failures stem from these fundamental configuration issues rather than complex technical problems.

You've successfully learned to create secure ECR repositories with industry best practices built in from the start. You can now use aws ecr create-repository with security parameters and verify configurations with aws ecr describe-repositories.

Your secure repository includes automatic vulnerability scanning and immutable tags, providing both security monitoring and deployment consistency. These foundational skills prepare you for more advanced ECR operations like image lifecycle management and CI/CD integration.

In the upcoming practice exercises, you'll create your own secure repository, verify security settings, and explore the command outputs hands-on, reinforcing these concepts before moving to image pushing in the next lesson.