How to download or tag an untagged image on ECR?

Assuming an ECR repository arn of 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository:

To pull a docker image that is untagged, use the sha that you can copy from the ECR repository for your untagged image (Thanks to @Győző Papp' answer), eg:

docker pull 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository@sha256:bee1809b6ab2918yfdjsajhf21398f41cfc2dcc69d27253

To retag it once pulled, use docker tag with whatever tag you want, the below example tags it with the tag my-new-tag:

docker tag 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository@sha256:bee1809b6ab2918yfdjsajhf21398f41cfc2dcc69d27253 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository:my-new-tag

Then push the tagged version back to AWS ECR:

docker push 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository:my-new-tag

You'll need to log in to ECR locally first using get-login first though...

You must use another notation that AWS suggests on its UI recently (it may not have been available that time):

docker pull myarn.amazonaws.com/sandbox@sha256:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365

At least it did work with my untagged images.

So I discovered a user-unfriendly way of doing this. You first tag an untagged image, then you can download it. Here I tag an untagged image to backup

MANIFEST=$(aws ecr batch-get-image --repository-name sandbox --image-ids imageDigest=sha256:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365 --query 'images[].imageManifest' --output text)
aws ecr put-image --repository-name sandbox --image-tag backup --image-manifest "$MANIFEST"

Then I can download it as normal

docker pull myarn.amazonaws.com/sandbox:backup