You can back up AWS Elastic Container Registry (ECR) to Commvault Unified Data Vault, leveraging Commvault's secure, scalable storage while maintaining your existing backup workflows.

Backing Up AWS ECR to Unified Data Vault

Commvault's AWS ECR backup and restore connector is a command-line tool that automates the backup of AWS ECR repositories, image manifests, and image layers to Commvault Unified Data Vault. It supports listing backups and restoring images to AWS ECR or a local Docker daemon.

Before You Begin

System Requirements:

A Linux machine with Python 3+ and Docker installed that can access both AWS ECR and the Commvault S3 endpoint.
Download the AWS ECR backup and restore connector:

Download the connector from Commvault Store and follow the setup instructions in the readme file.
Unified Data Vault Setup:

Ensure that your infrastructure administrator has created an S3 endpoint.
1. Create a Unified Data Vault.
2. Get Unified Data Vault Keys.

Configuration

Configure the connector using a config.yaml file that contains AWS and Unified Data Vault connection details. For enhanced security, reference environment variables for sensitive credentials.

Example configuration:

aws:
  region: "us-east-1"
  accessKeyId: ""
  secretAccessKey: ""

s3:
  endpoint: "https://s3-vault-endpoint:8403"
  bucket: "ecr-backup-vault"
  access_key: ""
  secret_key: ""
  region: "east-us-1"

The packaged download includes a config.yaml template file.

Configuration Parameters:

aws.region - Base AWS region for discovering additional regions
aws.accessKeyId - AWS access key ID or environment variable (e.g., ${AWS_ACCESS_KEY_ID})
aws.secretAccessKey - AWS secret access key or environment variable (e.g., ${AWS_SECRET_ACCESS_KEY})
s3.endpoint - Unified Data Vault endpoint URL with protocol and port
s3.bucket - Bucket name where ECR backups are stored
s3.access_key - Unified Data Vault access key or environment variable (e.g., ${S3_VAULT_ACCESS_KEY})
s3.secret_key - Unified Data Vault secret key or environment variable (e.g., ${S3_VAULT_SECRET_KEY})
s3.region - Vault region, typically us-east-1 for Commvault Unified Data Vault

Authentication:

The connector supports authentication using access and secret keys specified in config.yaml.

Output Locations:

The connector stores output in the following locations:

Logs - Written to logs/ecr_backup.log on the machine where the connector runs
Control files - Stored as control/state.json and control/index.json in the configured Unified Data Vault bucket
Restored images - Loaded into the local Docker daemon when performing a local restore

Run AWS ECR Backup

Back up your AWS ECR repositories to Unified Data Vault using the following commands.

Incremental Backup:

By default, only new images or images with changed digests are backed up:

./backup_ecr --backup

Example output:

2026-06-17 18:35:06,381 | INFO | Loading config...
2026-06-17 18:35:06,383 | INFO | Config loaded successfully
2026-06-17 18:35:06,383 | INFO | ===== STARTING BACKUP =====
2026-06-17 18:35:07,460 | INFO | [MODE] All regions
2026-06-17 18:35:17,042 | INFO | [REGION START] ap-south-2
2026-06-17 18:35:17,494 | INFO | Total repositories: 0
2026-06-17 18:35:17,494 | INFO | [REGION COMPLETE] ap-south-2
...
2026-06-17 18:35:40,229 | INFO | [REGION START] us-east-1
2026-06-17 18:35:42,290 | INFO | Total repositories: 1
2026-06-17 18:35:47,177 | INFO | Fetching images for repo: backend-services
2026-06-17 18:35:47,497 | INFO | Repo backend-services has 9 images
2026-06-17 18:35:47,498 | INFO | [SKIP] us-east-1/backend-services:nginx-proxy-v1.2.1
2026-06-17 18:35:47,498 | INFO | [BACKUP START] us-east-1/backend-services:api-gateway-v2.0.5
2026-06-17 18:35:47,498 | INFO | [JOB-d9e200f1-2bf6-4a87-b520-a90f0d816afa] Processing us-east-1/backend-services:api-gateway-v2.0.5
2026-06-17 18:35:48,342 | INFO | [JOB-d9e200f1-2bf6-4a87-b520-a90f0d816afa] Layer 1/2 sha256:3cb067eab609...
2026-06-17 18:36:04,147 | INFO | [MPU] Completed successfully: .../layers/sha256:3cb067eab609...
2026-06-17 18:36:04,147 | INFO | [JOB-d9e200f1-2bf6-4a87-b520-a90f0d816afa] Layer 2/2 sha256:76cbedd71a05...
2026-06-17 18:36:12,393 | INFO | [MPU] Completed successfully: .../layers/sha256:76cbedd71a05...
2026-06-17 18:36:13,367 | INFO | [BACKUP SUCCESS] us-east-1/backend-services:api-gateway-v2.0.5 - State saved
...
2026-06-17 18:37:10,548 | INFO | [REGION COMPLETE] us-east-1
...
2026-06-17 18:37:24,741 | INFO | ===== BACKUP COMPLETED =====

Full Backup:

Force a full backup to include all images regardless of change status:

./backup_ecr --backup --force-backup

Example output:

2026-06-17 19:00:38,314 | INFO | Loading config...
2026-06-17 19:00:38,316 | INFO | Config loaded successfully
2026-06-17 19:00:38,316 | INFO | ===== STARTING BACKUP =====
2026-06-17 19:00:39,386 | INFO | [MODE] All regions
2026-06-17 19:00:41,790 | INFO | [REGION START] ap-south-2
2026-06-17 19:00:42,221 | INFO | Total repositories: 0
2026-06-17 19:00:42,222 | INFO | [REGION COMPLETE] ap-south-2
...
2026-06-17 19:01:11,370 | INFO | [REGION START] us-east-1
2026-06-17 19:01:13,354 | INFO | Total repositories: 1
2026-06-17 19:01:14,111 | INFO | [META BACKUP] us-east-1/backend-services
2026-06-17 19:01:16,957 | INFO | [META SUCCESS] us-east-1/backend-services - State saved
2026-06-17 19:01:17,177 | INFO | Fetching images for repo: backend-services
2026-06-17 19:01:17,497 | INFO | Repo backend-services has 9 images
2026-06-17 19:01:17,498 | INFO | [BACKUP START] us-east-1/backend-services:api-gateway-v2.0.5
2026-06-17 19:01:17,498 | INFO | [JOB-a16cde50-29c1-4322-a45c-c7eb75334d05] Processing us-east-1/backend-services:api-gateway-v2.0.5
2026-06-17 19:01:18,042 | INFO | [JOB-a16cde50-29c1-4322-a45c-c7eb75334d05] Layer 1/2 sha256:3cb067eab609...
2026-06-17 19:01:20,760 | INFO | [MPU] Completed successfully: .../layers/sha256:3cb067eab609...
2026-06-17 19:01:20,761 | INFO | [JOB-a16cde50-29c1-4322-a45c-c7eb75334d05] Layer 2/2 sha256:76cbedd71a05...
2026-06-17 19:01:28,781 | INFO | [MPU] Completed successfully: .../layers/sha256:76cbedd71a05...
2026-06-17 19:01:32,440 | INFO | [BACKUP SUCCESS] us-east-1/backend-services:api-gateway-v2.0.5 - State saved
...
2026-06-17 19:02:26,017 | INFO | [REPO COMPLETE] us-east-1/backend-services - State saved
2026-06-17 19:02:26,017 | INFO | [REGION COMPLETE] us-east-1
...
2026-06-17 19:05:55,458 | INFO | ===== BACKUP COMPLETED =====

Backup Specific Regions:

Override the default region configuration to back up from specific AWS regions:

./backup_ecr --backup --regions us-east-1,us-west-2

Example output:

2026-06-17 19:08:57,222 | INFO | Loading config...
2026-06-17 19:08:57,224 | INFO | Config loaded successfully
2026-06-17 19:08:57,224 | INFO | ===== STARTING BACKUP =====
2026-06-17 19:08:57,357 | INFO | [MODE] Selected regions: ['us-east-1', 'us-west-2']
2026-06-17 19:08:59,183 | INFO | [REGION START] us-east-1
2026-06-17 19:09:01,152 | INFO | Total repositories: 2
2026-06-17 19:09:03,878 | INFO | Repo web-frontend has 4 images
2026-06-17 19:09:03,879 | INFO | [SKIP] us-east-1/web-frontend:react-app-v3.1.2
2026-06-17 19:09:03,879 | INFO | [SKIP] us-east-1/web-frontend:node-server-v1.8.0
2026-06-17 19:09:03,879 | INFO | [SKIP] us-east-1/web-frontend:webpack-builder-v5.2.1
2026-06-17 19:09:05,064 | INFO | [REPO COMPLETE] us-east-1/web-frontend - State saved
2026-06-17 19:09:07,297 | INFO | Repo backend-services has 9 images
2026-06-17 19:09:07,298 | INFO | [SKIP] us-east-1/backend-services:nginx-proxy-v1.2.1
2026-06-17 19:09:07,298 | INFO | [SKIP] us-east-1/backend-services:api-gateway-v2.0.5
2026-06-17 19:09:07,298 | INFO | [SKIP] us-east-1/backend-services:worker-service-v1.5.3
2026-06-17 19:09:07,298 | INFO | [SKIP] us-east-1/backend-services:cache-redis-v6.2.4
2026-06-17 19:09:08,485 | INFO | [REPO COMPLETE] us-east-1/backend-services - State saved
2026-06-17 19:09:08,486 | INFO | [REGION COMPLETE] us-east-1
2026-06-17 19:09:08,486 | INFO | [REGION START] us-west-2
2026-06-17 19:09:10,675 | INFO | Total repositories: 0
2026-06-17 19:09:10,676 | INFO | [REGION COMPLETE] us-west-2
2026-06-17 19:09:11,864 | INFO | ===== BACKUP COMPLETED =====

List AWS ECR Backups

View all available backups stored in Unified Data Vault:

./backup_ecr --list-backup

Example output:

2026-06-17 19:14:15,653 | INFO | Loading config...
2026-06-17 19:14:15,655 | INFO | Config loaded successfully
2026-06-17 19:14:15,655 | INFO | ===== LIST BACKUPS =====
2026-06-17 19:14:15,655 | INFO | Creating S3 client...
2026-06-17 19:14:15,737 | INFO | Loading control/index.json from S3

Region: us-east-1
  Repo: web-frontend
    [Metadata Snapshots]
      - 2026-06-17_13-31-14
      - 2026-05-21_11-34-00
    Tag: react-app-v3.1.2
      - 2026-06-17_13-31-32
      - 2026-05-21_11-34-24
  Repo: backend-services
    [Metadata Snapshots]
      - 2026-06-17_13-32-26
      - 2026-05-21_11-35-23
    Tag: api-gateway-v2.0.5
      - 2026-06-17_13-35-41
      - 2026-05-21_11-38-21
    Tag: nginx-proxy-v1.2.1
      - 2026-06-17_13-35-29
      - 2026-05-21_11-38-09

Region: us-east-2
  Repo: data-pipeline-prod
    [Metadata Snapshots]
      - 2026-06-17_13-37-30
      - 2026-05-21_11-43-52
    Tag: spark-processor-v4.1.0
      - 2026-05-21_11-50-32
    Tag: kafka-consumer-v2.3.2
      - 2026-05-21_11-43-55

Region: us-west-1
  Repo: monitoring-stack
    [Metadata Snapshots]
      - 2026-05-21_11-58-23
    Tag: prometheus-exporter-v3.2.0
      - 2026-05-21_11-58-25

Restore AWS ECR Backups

Restore images from a backup using the interactive restore process:

./backup_ecr --restore

Example output:

2026-06-17 19:16:12,433 | INFO | Loading config...
2026-06-17 19:16:12,435 | INFO | Config loaded successfully
2026-06-17 19:16:12,435 | INFO | ===== INTERACTIVE RESTORE =====
2026-06-17 19:16:12,435 | INFO | Creating S3 client...
2026-06-17 19:16:12,518 | INFO | Loading control/index.json from S3

Select Region
1. us-east-1
2. us-east-2
3. us-west-1
Choose: 1

Select Repository
1. web-frontend
2. backend-services
Choose: 2

Select Tag
1. api-gateway-v2.0.5
2. nginx-proxy-v1.2.1
3. worker-service-v1.5.3
4. cache-redis-v6.2.4
Choose: 1

Destination
1. aws
2. local
Choose: 1
2026-06-17 19:16:24,119 | INFO | Found credentials in shared credentials file: ~/.aws/credentials
2026-06-17 19:16:24,167 | INFO | [RESTORE] us-east-1/backend-services:api-gateway-v2.0.5
2026-06-17 19:16:25,842 | INFO | [RESTORE] Repository already exists: backend-services
2026-06-17 19:16:25,842 | INFO | [RESTORE] Layer 1/3 sha256:b52e0b094bc0...
2026-06-17 19:16:25,842 | INFO | [RESTORE] Fetching layer from S3: sha256:b52e0b094bc0...
2026-06-17 19:16:33,053 | INFO | [RESTORE] Uploaded 0 MB for sha256:b52e0b094bc0...
2026-06-17 19:16:33,776 | INFO | [RESTORE] Layer already exists, skipping sha256:b52e0b094bc0...
2026-06-17 19:17:33,450 | INFO | [RESTORE] Image registered successfully: backend-services:api-gateway-v2.0.5
2026-06-17 19:17:33,451 | INFO | [RESTORE] Completed backend-services:api-gateway-v2.0.5
2026-06-17 19:17:33,451 | INFO | [RESTORE] Successfully restored backend-services:api-gateway-v2.0.5 to AWS ECR
2026-06-17 19:17:33,453 | INFO | ===== RESTORE COMPLETED =====

The restore process reads the backup index from Unified Data Vault and prompts you to select a region, repository, and tag. You can then restore the image to AWS ECR or load it into your local Docker daemon using docker load.

Command Reference

Usage:

./backup_ecr [--backup] [--list-backup] [--restore] [--force-backup] [--regions REGIONS]

Options:

Option	Description
`--backup`	Run ECR backup
`--force-backup`	Force full backup, re-uploading all images
`--regions REGIONS`	Comma-separated AWS regions (e.g., us-east-1,us-west-2)
`--list-backup`	List available backups
`--restore`	Restore backup interactively
`-h`	Show help message

Backing Up AWS ECR to Unified Data Vault

Backing Up AWS ECR to Unified Data Vault

Before You Begin

Configuration

Run AWS ECR Backup

List AWS ECR Backups

Restore AWS ECR Backups

Command Reference

Page contents