Is your container registry quietly inflating your monthly AWS bill? Understanding how Amazon ECR balances storage, data transfer, and scanning fees is the first step toward reclaiming your cloud budget.
Storage costs for private and public repositories
For private repositories, Amazon ECR charges a flat rate of $0.10 per GB-month for data stored. New AWS customers can leverage the Free Tier, which includes 500 MB of storage per month for one year. However, in enterprise environments where images are built and pushed multiple times per day, storage usage can balloon if not actively managed.
Public repositories offer a more generous always-free tier of 50 GB of storage per month. Beyond that, the same $0.10 per GB-month rate applies. It is important to note that storage charges are always billed to the AWS account that owns the repository, regardless of who is pulling the images. To keep these costs under control, you should implement Amazon ECR cost optimization strategies, such as using multi-stage Docker builds to ensure only the necessary artifacts are stored in the final image layers, which reduces the footprint of deduplicated layers.
The high price of data transfer and NAT gateways
The sticker price for ECR often hides the most expensive part of the service: data egress. While pushing images to ECR is free, pulling them involves a tiered pricing structure depending on the destination and the distance the data travels.
- In-Region Transfer: Pulling images to an AWS compute service like EC2 or Fargate in the same Region is free of charge.
- Internet Egress: Pulling images from a private repository to the internet starts at $0.09 per GB for the first 10 TB, matching standard AWS data transfer costs.
- Cross-Region Replication: If you configure ECR to replicate images across regions for disaster recovery, you pay for both the data transfer out of the source region and the storage in the destination region.
The most common hidden expense occurs when private instances pull images through a NAT Gateway. AWS charges a data processing fee of $0.045 per GB for NAT Gateway traffic. For container-heavy workloads, this can result in thousands of dollars in unnecessary fees. By deploying AWS PrivateLink interface VPC endpoints, you can pull images over the AWS private network, which is approximately 78% cheaper per GB than routing that same traffic through a NAT Gateway.
Understanding image scanning fees
Security is a core component of container management, and Amazon ECR provides two tiers of vulnerability scanning to help you identify risks before deployment.
- Basic Scanning: This is available at no additional cost. It allows you to scan images for vulnerabilities once every 24 hours, covering the initial scan on push and manual scans.
- Enhanced Scanning: This integration with Amazon Inspector provides continuous scanning and more granular vulnerability database coverage. While there is no fee from ECR itself, you are billed through Amazon Inspector. In the United States, this costs $0.09 per image for the initial scan and $0.01 for each automated rescan.
For organizations with thousands of images, enhanced scanning can add a predictable but meaningful overhead to the monthly bill. If your CI/CD pipeline pushes multiple versions of the same image daily, ensure your AWS Fargate cost optimization includes a review of how many of these images actually require continuous monitoring versus basic point-in-time scans.
Budgeting and lifecycle optimization
The most effective way to lower your ECR bill is to stop paying for what you do not use. Lifecycle policies allow you to automate the deletion of untagged images or older versions that are no longer needed. Implementing a policy to delete untagged images after 24 hours and retaining only a limited number of tagged images can reduce storage requirements by up to 90% in active development environments.
If you are currently struggling to estimate your upcoming cloud spend, using an AWS cost savings calculator can help you model different scenarios, such as moving from NAT Gateways to VPC Endpoints or adjusting your image retention policies. Navigating the complexities of AWS ECR pricing requires a balance between architectural performance and cost efficiency. While storage and scanning are often predictable, data transfer and networking choices represent the most significant opportunities for immediate savings.
At Hykell, we specialize in identifying these inefficiencies and implementing automated optimizations that reduce your total AWS spend by up to 40%. Our performance-safe approach operates on autopilot, ensuring you never overpay for infrastructure while maintaining peak reliability. If you are ready to stop the drain on your cloud budget, see how much you could save with our free optimization audit.
