One ECR, Many Accounts

The instinct is to give every account its own registry. It feels tidy. It is also how you end up promoting a staging image that was never the thing you tested.

The pattern

Build once. Push to a single ECR in the production account. Grant dev and staging pull access via a repository policy. Every environment runs the exact same image digest, promoted forward, never rebuilt.

Why it holds up

The image that passed tests in dev is byte-for-byte the image that ships. No drift, no surprise rebuilds, one place to scan for vulnerabilities. CDK manages the repository and the cross-account policy, so the whole thing is code you can review.