Security group egress rule to only permit ECR requests

Question

When using ECR to store container images for use with ECS, the EC2 instance (or Fargate service) must have a security group that permits access (over the public internet) to the account-specific repository URI.

Many organisations have strict IP whitelisting rules, which generally doesn't permit enabling outbound port 443 for all IPs.

There's no VPC endpoint interface/gateway available for ECR, and presumably like most AWS services, its IP address is elastic and could change at any point.

So how an you add an egress rule to a security group that permits outbound access over port 443 to an ECR URI, without opening it up to all IP addresses?

Answer 1

You can use AWS PrivateLink to achieve this; see Amazon ECR interface VPC endpoints (AWS PrivateLink).