[ECR] [request]: Private repository support for requester pays

[tamir-deep]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request
ECR private repositories support repository permissions (resource based policy) which allows the owner to share its content across AWS organizations and accounts.

The data transfer however is billed on the owner instead of the requester without any ability to change it. Source

We want to be able for one account to host a private repository in ECR which allows other accounts (whether within the org or external) to pull images from but for the account that requests the content to pay for it.

Some organizations may want to have the accounts that requests the images to pay instead of the "shared services" account that hosts all the images in the organization for example.

This is needed especially for ISV that hosts private images for their customers and grants read access to external accounts upon purchase.
(I'm leaving out the Marketplace service where the seller uploads the images to AWS-owned ECR private repository which DOES apply "requester pays" according to AWS MP support team).

Which service(s) is this request for?
ECR

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
In case of large scaling of containers (EKS, ECS, and even more so, Fargate where there is no node image caching), the images are downloaded and billed upon the repository owner according to the official ECR pricing documentation.

This can lead to huge bills and even "abuse" in some rare cases.

By being able to apply "requester pays", it could make a huge cost difference in the way ISVs can serve their container images to their customers in AWS.

Are you currently working around this issue?
There is no workaround AFAIK.
The only way is to ask the requester to COPY the image / replicate the repository to their own account.