Amazon ECR

Connect Amazon Elastic Container Registry (ECR) to Safeguard. The IAM permissions the access key needs, which credentials work, and step-by-step setup.

What it does

The Amazon ECR card connects Safeguard to your container images in Amazon Elastic Container Registry, private repositories and ECR Public. Safeguard lists your repositories and image tags, and each image you select becomes a project that Safeguard scans for an SBOM and vulnerability findings. Find the card under Integrations on the Project/Product tab.

Public vs private

	Public	Private
What you enter	An ECR Public image URL (`public.ecr.aws/<alias>/<repo>` or `gallery.ecr.aws/<alias>/<repo>`)	AWS Account ID, region, Access Key ID and Secret Access Key
Credential needed	None	An IAM access key with read access to ECR
What you can select	The public repositories you add by URL	Every repository the key can describe in that account and region

Private image scans

Safeguard uses the access key to list your repositories and tags. The scan's image pull does not use this key yet, so a private image the scanner cannot pull is reported as a failed scan with the registry's error.

Supported auth methods

Method	Use it when	Notes
IAM user access key (Access Key ID and Secret Access Key)	Private repositories	The only private method today. Use a dedicated IAM user with read-only ECR access.
None (ECR Public)	Public images	Nothing to create.

Assuming an IAM role (role ARN and external ID) is not available yet.

Permissions required

Safeguard only reads from ECR. It never pushes, deletes or changes repositories, images or policies.

IAM user access key

IAM action	Required?	What Safeguard uses it for
`ecr:DescribeRepositories`	Required	Checking the key when you click Verify Credentials, and listing your repositories
`ecr:GetAuthorizationToken`	Required	Checking the key, and resolving the registry address of an image. AWS requires it on `"Resource": "*"`
`ecr:DescribeImages`	Required	Listing the tags of a repository
`ecr:BatchGetImage`	Recommended	Reading an image manifest when the image is pulled for a scan
`ecr:GetDownloadUrlForLayer`	Recommended	Downloading image layers when the image is pulled for a scan
`ecr:BatchCheckLayerAvailability`	Recommended	Part of AWS's standard set of pull actions

Least privilege: attach the AWS managed policy AmazonEC2ContainerRegistryReadOnly (it contains all of the above and other read-only actions), or an inline policy with exactly the actions in the table. You can scope every action except ecr:GetAuthorizationToken to specific repository ARNs:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "ecr:GetAuthorizationToken", "Resource": "*" },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:DescribeRepositories",
        "ecr:DescribeImages",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Resource": "arn:aws:ecr:<region>:<account-id>:repository/*"
    }
  ]
}

Token types

Credential type	Works?	Notes
IAM user access key with read-only ECR policy	Yes (recommended)	Create it for a dedicated IAM user used only by Safeguard
IAM user access key with broader permissions (for example `AmazonEC2ContainerRegistryFullAccess` or `PowerUser`)	Works, not recommended	Safeguard never uses the extra permissions
Root user access key	Never	AWS says not to create access keys for the root user
Temporary credentials (session token from STS or IAM Identity Center)	No	The form has no session token field, and they expire within hours
IAM role assumed by Safeguard	Not available yet

Expiry: IAM access keys do not expire on their own. Rotate the key at least every 90 days, or sooner if your policy says so.

What we never need: push actions (ecr:PutImage, ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload), delete actions, repository or lifecycle policy changes, or any permission outside ECR.

Step-by-step setup

Create the credential in AWS

Open the IAM console and choose Users, then create a user for Safeguard (for example safeguard-ecr-read). It needs no console access.
On the user's Permissions tab, attach AmazonEC2ContainerRegistryReadOnly, or the inline policy shown above.
On the user's Security credentials tab, in Access keys, choose Create access key.
On Access key best practices & alternatives, choose Other, then Next, then Create access key.
On Retrieve access key, choose Show and copy the Access Key ID and Secret Access Key. AWS shows the secret only this once.

Or with the AWS CLI

aws iam create-user --user-name safeguard-ecr-read
aws iam attach-user-policy --user-name safeguard-ecr-read \
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
aws iam create-access-key --user-name safeguard-ecr-read
# Your account ID, for the form:
aws sts get-caller-identity --query Account --output text

Connect it in Safeguard

Open Integrations and choose the Project/Product tab.
Click Connect on the Amazon ECR card.
For public images, choose Public, enter a Name, paste an ECR Public URL and click Add. Then click Next.
For private repositories, choose Private and fill in Name, Account ID, Region, AWS Access Key ID and AWS Secret Access Key.
Click Verify Credentials. "AWS credentials validated successfully" means Safeguard could describe your repositories.
Click Next, select the repositories and tags to scan, review, and choose a connect option (fast, progressive or deep scan).

Webhooks and triggers

This integration has no webhooks. Each selected image is scanned when you connect it; to rescan new tags, set a schedule under Integrations > Scheduled or rescan by hand from the project.

What we read and store

Read: repository names and ARNs, image tags and push dates in the account and region you enter, and the images you select for scanning.
Stored: the connection's settings, the SBOM and findings of each scanned image, and the access key, which is encrypted at rest and never shown again after you save it.
Not stored: image layers. The image is read for the scan and not kept.
No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Message you see	Cause	Fix
`Please enter all AWS credentials to verify`	A field of the private form is empty	Fill in Account ID, Region, Access Key ID and Secret Access Key
`Invalid AWS credentials. Please check your details.`	AWS refused the key, or the key lacks `ecr:DescribeRepositories` or `ecr:GetAuthorizationToken`	Check the key is active and attach the policy above
`Region is required for private AWS ECR`	No region was chosen	Choose the region your repositories are in
`Registry ID (AWS Account ID) is required for private AWS ECR`	The Account ID is empty	Enter the 12-digit account ID
`Invalid ECR Public URL format. Expected: public.ecr.aws/<alias>/<repo> or gallery.ecr.aws/<alias>/<repo>`	The public URL is not an ECR Public address	Copy the image URL from the ECR Public Gallery
`Private AWS ECR requires authentication. Use public.ecr.aws or gallery.ecr.aws for public images.`	A private registry address was entered on the Public tab	Use the Private tab with an access key
`Failed to fetch tags: ...`	The key lacks `ecr:DescribeImages`, or the repository is in another region	Add the action, or connect the other region separately

Rotation and disconnect

Rotate: create a second access key for the same IAM user, find the connection under Project Configurations on the Project/Product tab, choose Update from its menu, paste the new keys and save, then deactivate and delete the old key in IAM.
Disconnect: choose Delete from the connection's menu under Project Configurations and confirm Delete configuration, then delete the access key (or the whole IAM user) in IAM.

Vendor references

AmazonEC2ContainerRegistryReadOnly managed policy, checked 2026-10-16.
Private repository policy examples in Amazon ECR, checked 2026-10-16.
Manage access keys for IAM users, checked 2026-10-16.
How an IAM administrator can manage IAM user access keys, checked 2026-10-16.

Amazon ECR

On this page