Overview

Amazon Elastic Container Registry (ECR) is a fully managed Docker container registry that helps developers store, manage, and deploy Docker container images. Typically, ECR images are accessed through a URL in the format ``````<aws_account_id>`````.dkr.ecr.``<region>``.amazonaws.com`. However, there are scenarios where configuring a custom domain name for ECR becomes advantageous, especially when integrating it into a more extensive infrastructure, securing it with HTTPS via your certificates, or simply providing a more recognizable and branded URL. This article details how to configure a custom domain name for Amazon ECR.

Prerequisites

1. AWS Account: Ensure that you have an active AWS account with the necessary permissions.
2. Domain Name: A domain name purchased and managed via AWS Route 53 or another domain registrar.
3. AWS Certificate Manager: To provision and manage SSL certificates.
4. CloudFront Distribution: It will serve as a distribution point for ECR, allowing custom domain configuration and HTTPS support.

Steps to Configure a Custom Domain Name for Amazon ECR

Step 1: Obtain a Public SSL/TLS Certificate

1. Navigate to AWS Certificate Manager (ACM):
   • Go to the AWS Management Console.
   • Locate and open AWS Certificate Manager.
2. Request a Certificate:
   • Click on "Request a certificate."
   • Choose "Request a public certificate."
   • Enter your desired custom domain name (e.g., `images.example.com`) and any alternative names if needed.
   • Validate the domain using either DNS or Email. DNS validation is recommended as it’s automated and efficient.

Step 2: Set up Amazon CloudFront Distribution

1. Create a Distribution:
   • Go to the AWS Management Console and open Amazon CloudFront.
   • Create a new distribution and select the "Web" option.
2. Configure Origin Settings:
   • Origin Domain Name: Enter your ECR repository URL (e.g., `123456789012.dkr.ecr.us-east-1.amazonaws.com`).
   • Leave the "Origin Path" field empty.
3. Set Custom Headers:
   • Optionally, add custom headers if they are required for authorization or other purposes.
4. Configure Cache Behavior Settings:
   • Viewer Protocol Policy: Redirect HTTP to HTTPS (to maintain secure connections).
   • Allowed HTTP Methods: Select the allowed methods as per your needs (GET, HEAD, OPTIONS are the most commonly used for public content delivery).
5. Set Custom Domain Name:
   • Add your custom domain name under the "Alternate Domain Names (CNAMEs)" section (e.g., `images.example.com`).
6. Attach SSL Certificate:
   • Select the SSL certificate previously obtained from ACM for HTTPS.
7. Create Distribution:
   • Finalize the configuration and create the CloudFront distribution.

Step 3: Update DNS Settings

1. Route 53 Configuration:
   • Navigate to the AWS Route 53 console.
   • Select the hosted zone of your domain.
   • Create a new record set.
   • Enter your desired subdomain (e.g., `images`) and set the type to `A` or `AAAA` if using IPv6.
   • Choose "Alias" and link it to the CloudFront distribution.
2. External DNS Configuration:
   • If using another DNS provider, update the CNAME record to point to the CloudFront distribution domain name provided. Deployment across other providers involves similar steps.

Step 4: Test the Custom Domain Configuration

After the DNS changes propagate (which may take some time), access your ECR repository via the custom domain ensure secure connectivity and expected functionality.

Conclusion

Setting up a custom domain for Amazon ECR involves orchestrating several AWS services, like CloudFront and ACM, alongside DNS configuration. While initially complex, this setup enhances your branding, security, and integration flexibility. Secure access via HTTPS strengthens the reliability and professionalism of the services you deliver.

Summary Table

By following this guide, you'll have successfully configured a custom domain to access your Amazon ECR repositories, improving both visibility and security.