Cache bucket and pull-through cache
S3 and ECR prerequisites
The S3 bucket and ECR pull-through cache BYOC uses, how they are configured, and the endpoints that keep their traffic off NAT.
BYOC needs somewhere to put cache objects and somewhere to pull images from. Both live in your account.
S3 cache bucket
- Created by the module with default encryption and public access blocked
- Lifecycle rule expires cache objects after your retention window
- Add an S3 gateway VPC endpoint — free, and removes cache traffic from NAT entirely
ECR pull-through cache
- Caches upstream images inside your account on first pull
- Removes Docker Hub rate limits, which is often the more urgent problem
- Add an ECR interface endpoint so image pulls also avoid NAT
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.