api.ecr.eu-west-2.amazonaws.com resolves to external IP instead of interface endpoint

Question

We have setup multiple endpoints all the same way within our organisation but the api.ecr.eu-west-2.amazonaws.com seems to resolve to the external IP rather than the interface endpoints. An example of the different responses can be seen below, is there a reason for this or a fix?

```
$ nslookup rds.eu-west-2.amazonaws.com
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   rds.eu-west-2.amazonaws.com
Address: 172.16.1.60
Name:   rds.eu-west-2.amazonaws.com
Address: 172.16.2.132
Name:   rds.eu-west-2.amazonaws.com
Address: 172.16.3.168

$ nslookup api.ecr.eu-west-2.amazonaws.com
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
api.ecr.eu-west-2.amazonaws.com canonical name = ecr.eu-west-2.amazonaws.com.
Name:   ecr.eu-west-2.amazonaws.com
Address: 52.94.53.88
```

Answer

Might be worth checking which ECR endpoint type you used, as there are two options when creating an endpoint for ECR:

com.amazonaws.region.ecr.dkr: This endpoint is used for the Docker Registry APIs. Docker client commands such as push and pull use this endpoint.

com.amazonaws.region.ecr.api: This endpoint is used for calls to the Amazon ECR API. API actions such as DescribeImages and CreateRepository go to this endpoint.

I've tested, and confirmed an nslookup with com.amazonaws.region.ecr.api returns the interface endpoint.

api.ecr.eu-west-2.amazonaws.com resolves to external IP instead of interface endpoint

Relevant content