# ECR Container Registry Enumeration

> Techniques for enumerating AWS ECR repositories, images, and metadata to identify exposed containers, misconfigurations, and sensitive data in registries.

- **URL:** https://hackindex.io/platforms/aws/enumeration/ecr/ecr-container-registry-enumeration
- **Path:** AWS > Enumeration > ECR
- **Up:** [ECR](https://hackindex.io/platforms/aws/enumeration/ecr.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

Container images frequently contain hardcoded secrets, internal service URLs, and build-time credentials. Pulling and inspecting images requires only `ecr:GetAuthorizationToken` and `ecr:BatchGetImage`.

- Environment variables baked into image config (API keys, DB passwords)
- Build-time secrets leaked through `ARG` and `RUN` instructions in layer history
- Repository policies with `Principal: *` granting cross-account or public pull access
- Internal service URLs and hostnames in config files within image layers

## List Repositories

```bash
aws ecr describe-repositories --profile $PROFILE --region $REGION --query 'repositories[*].{Name:repositoryName,URI:repositoryUri,Created:createdAt}' --output table
```

## List Images in a Repository

```bash
aws ecr list-images --repository-name $REPO_NAME --profile $PROFILE --region $REGION --query 'imageIds[*].{Tag:imageTag,Digest:imageDigest}' --output table
```

**Full image details**

```bash
aws ecr describe-images --repository-name $REPO_NAME --profile $PROFILE --region $REGION --query 'imageDetails[*].{Digest:imageDigest,Tags:imageTags,Size:imageSizeInBytes,Pushed:imagePushedAt}' --output table
```

## Authenticate Docker to ECR

```bash
aws ecr get-login-password --profile $PROFILE --region $REGION | docker login --username AWS --password-stdin $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com
```

## Pull and Inspect an Image

```bash
docker pull $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG
docker inspect $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG
```

**Check baked-in environment variables**

```bash
docker inspect $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG | jq '.[0].Config.Env'
```

## Extract Secrets from Image Layers

Image history shows build commands including any credentials passed as `ARG` or `RUN` steps:

```bash
docker history --no-trunc $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG
```

**Full layer extraction**

```bash
docker save $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG -o image.tar
mkdir image_layers && tar xf image.tar -C image_layers/
find image_layers/ -name "*.tar" -exec tar xf {} -C image_layers/ \;
grep -r "key\|secret\|password\|token\|credential\|aws_" image_layers/ -i --include="*.env" --include="*.conf" --include="*.json" --include="*.yml" 2>/dev/null
```

## Repository Policy

Check if the repository allows cross-account or public access:

```bash
aws ecr get-repository-policy --repository-name $REPO_NAME --profile $PROFILE --region $REGION | jq '.policyText | fromjson'
```

`"Principal": "*"` in the policy means anyone can pull from the repository.

## Public ECR Gallery

Public repositories on ECR Public Gallery (`public.ecr.aws`) require no authentication:

```bash
aws ecr-public describe-repositories --profile $PROFILE --region us-east-1
```