> For the complete documentation index, see [llms.txt](https://docs.hivel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hivel.ai/self-managed-hivel-deployment/virtual-private-cloud/aws/hivel-on-premises-deployment-guide-aws/ecr-access-configuration.md).
# ECR Access Configuration
Hivel's Docker images are stored in Amazon ECR. To deploy, you need authenticated access to pull these images.
## **Hivel's ECR Registry:**
```
730335373269.dkr.ecr.ap-south-1.amazonaws.com
```
## **About ECR Credentials**
Hivel issues you AWS Access Key ID and Secret Access Key scoped specifically to Hivel's ECR repository. This is a separate credential from your own AWS account credentials and cannot reach any other AWS resource in Hivel's account.
For credential rotation, contact your Hivel representative. There is no fixed self-serve rotation cadence. You can self-rotate your application's database password at any time without contacting Hivel; see [Security and Secrets](https://docs.hivel.ai/self-managed-hivel-deployment/virtual-private-cloud/aws/hivel-on-premises-deployment-guide-aws/security-and-secrets) for how credentials fit into the overall credential-handling approach.
## **Choose Your Option**
### **Option A: Use Hivel's ECR (Recommended)**
Choose this unless your organization requires images in your own infrastructure.
1. **Get credentials from Hivel:**
* AWS Access Key ID
* AWS Secret Access Key
2. **On your EC2 VM,** **Configure AWS CLI with Hivel's credentials:**
```
aws configure
# Enter Hivel's Access Key ID
# Enter Hivel's Secret Access Key
# Region: ap-south-1
# Output: json
```
**3. Test ECR access:**
```
# Test ECR login
aws ecr get-login-password --region ap-south-1 | \
docker login --username AWS --password-stdin \
730335373269.dkr.ecr.ap-south-1.amazonaws.com
# Should show: Login Succeeded
```
**Expected result:** Login Succeeded.
The deploy.sh script will automatically handle ECR authentication using these credentials.
### **Option B: Use Your Own ECR (Advanced)**
Choose this only if your organization requires container images in your own AWS infrastructure.
1. **Create ECR repositories in your AWS account for each Hivel service and push Hivel images to them. Note your ECR registry URL (e.g., `123456789.dkr.ecr.us-east-1.amazonaws.com`).**
2. **Update `services/vm/docker-compose.yml` . Replace all image URLs:**
Replace:
```
image: 730335373269.dkr.ecr.ap-south-1.amazonaws.com/hivel/...
```
With:
```
image: YOUR_ACCOUNT.dkr.ecr.YOUR_REGION.amazonaws.com/hivel/...
```
**3. Update `deploy.sh` . Change these variables:**
```
ECR_REGISTRY="730335373269.dkr.ecr.ap-south-1.amazonaws.com"
```
* Update to your ECR registry:
```
ECR_REGISTRY="YOUR_ACCOUNT.dkr.ecr.YOUR_REGION.amazonaws.com"
```
* Update region if different:
```
AWS_REGION="YOUR_REGION" # e.g., "us-east-1"
```
**4. Configure AWS CLI with your credentials:** *(if not already done during AWS CLI configuration)*
```
# Use your own AWS credentials
aws configure
```
**5. Test your ECR access:**
```
aws ecr get-login-password --region YOUR_REGION | \
docker login --username AWS --password-stdin \
YOUR_ACCOUNT.dkr.ecr.YOUR_REGION.amazonaws.com
```
**Expected result:**
`Login Succeeded`
#### **Files to Update (Option B Only)**
If using your own ECR, update these files:
* `services/vm/docker-compose.yml` : all `image:` lines
* `deploy.sh` : `ECR_REGISTRY` and `AWS_REGION` variables
\
{% columns %}
{% column %} Back to Project Setup and Environment Configuration
{% endcolumn %}
{% column %}
{% endcolumn %}
{% column %} Database Migration
{% endcolumn %}
{% endcolumns %}