AWS elasticbeanstalk documentation change

Service: elasticbeanstalk · 2025-08-25 · Documentation medium

File: elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md

Summary

Added Amazon ECR Public authentication documentation and updated content structure

Security assessment

Introduces IAM permissions for ECR Public authentication and explains security benefits of authenticated pulls. Enhances security posture but doesn't address a specific vulnerability.

Diff

diff --git a/elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md b/elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md
index 27d9426fc..f5a2239db 100644
--- a//elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md
+++ b//elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md
@@ -5 +5 @@
-Amazon ECR repositorySSM Parameter Store or AWS Secrets ManagerDockerrun.aws.json file
+Amazon ECR repositorySSM Parameter Store or AWS Secrets ManagerDockerrun.aws.json fileAmazon ECR Public images
@@ -7 +7 @@ Amazon ECR repositorySSM Parameter Store or AWS Secrets ManagerDockerrun.aws.jso
-# Using images from a private repository in Elastic Beanstalk
+# Authenticating with image repositories
@@ -9 +9 @@ Amazon ECR repositorySSM Parameter Store or AWS Secrets ManagerDockerrun.aws.jso
-This topic describes how to authenticate to a private online image repository with Elastic Beanstalk. Elastic Beanstalk must authenticate with the online registry before it can pull and deploy your images. There are multiple configuration options.
+This topic describes how to authenticate to online image repositories with Elastic Beanstalk. For private repositories, Elastic Beanstalk must authenticate before it can pull and deploy your images. For Amazon ECR Public, authentication is optional but provides higher rate limits and improved reliability.
@@ -220,0 +221,34 @@ After Elastic Beanstalk can authenticate with the online registry that hosts the
+## Using images from Amazon ECR Public
+
+Amazon ECR Public is a public container registry that hosts Docker images. While Amazon ECR Public repositories are publicly accessible, authenticating provides higher rate limits and better reliability for your deployments.
+
+###### Note
+
+Amazon ECR Public authentication is not supported in China regions (`cn-*`) and AWS GovCloud regions (`us-gov-*`). In these regions, Elastic Beanstalk will use unauthenticated pulls.
+
+To enable Amazon ECR Public authentication, add the following permissions to your environment's [instance profile](./concepts-roles-instance.html). For more information about Amazon ECR Public authentication, see [Registry authentication in Amazon ECR public](https://docs.aws.amazon.com/AmazonECR/latest/public/public-registries.html) in the _Amazon Elastic Container Registry Public User Guide_ :
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+           {
+              "Effect": "Allow",
+              "Action": [
+                 "ecr-public:GetAuthorizationToken",
+                 "sts:GetServiceBearerToken"
+              ],
+              "Resource": "*"
+           }
+        ]
+    }
+    
+
+Once these permissions are attached to your instance profile, Elastic Beanstalk will automatically authenticate with Amazon ECR Public registries. You can reference Amazon ECR Public images using the standard `public.ecr.aws/`registry-alias`/`repository-name:tag`` format in your `Dockerrun.aws.json` file or Dockerfile.
+