On the Amazon ECR Public Gallery, AWS accounts that publish popular or commonly used images can request a Verified account badge by contacting support. The badge marks the account, and the gallery lets you filter by verified accounts. AWS's page does not describe it as a security review of the images.
What the gallery is
AWS describes the Amazon ECR Public Gallery as a public website for finding and sharing container images hosted in Amazon ECR public repositories. You need no authentication to browse the public repositories and pull the images. Publishers create public repositories and define the catalog data shown in the gallery: name, short description, a detailed About tab and usage instructions on a Usage tab.
Because publishers write that catalog text themselves, the description is a claim by the publisher. Compare it with the project's own site before you rely on it.
The badge and the filters
The page says accounts that publish popular or commonly used images can request a Verified account badge by contacting support. Search filters include verified accounts, supported operating systems and system architectures.
Read that wording closely. The trigger is popularity or common use, and the process is a request through a support case. The page says nothing about a vulnerability review of the images. Treat the badge as a signal about the account, much like a verified publisher label on another registry.
A checklist for a gallery image
- Is the account verified, and does the account name match the vendor or project you expect?
- Does the About or Usage tab link to a source repository you recognise?
- Does the repository have recent updates, or has it gone quiet?
- Which architectures and operating systems does it list, and do they match your hosts?
- Pin the digest, scan it and record the result.
Anonymous pulls and your own controls
Since pulls need no sign-in, a gallery image can enter a build unnoticed. If your organisation uses an internal registry, decide whether the gallery is on your approved list, and if so, whether you copy images into your own repository after scanning. Referencing your own copy gives you control over when upstream changes reach you.
When the badge is missing
Many useful images come from accounts without it. Absence is not a warning on its own, and presence is not a clearance. Apply the same checks either way: publisher identity, source link, update history, scan, pinned digest.
Keeping a record
Whatever you decide about a gallery image, write it down. Note the repository URL, the account name, whether the badge was present on the day you checked, the digest you scanned and the date. Badges can be added or change over time, so a dated note shows what you saw when you made the call.
If you later need to find every workload that uses the image, that record, together with an SBOM per image, turns a search across teams into a lookup.
Quick check
Does a Verified account badge mean the image was security reviewed?
AWS's page describes it as available to accounts publishing popular or commonly used images on request. It does not describe a security review.
Do I need to sign in to pull from the gallery?
No. AWS says no authentication is required to browse the public repositories and pull the images.
Safeguard scans container images from any registry, records an SBOM and applies your policies before they ship. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
