Organizations in regulated industries run container workloads in air-gapped AWS environments, which means migrating hundreds of Helm charts and images into private Amazon ECR with consistent security controls. This post uses Amazon ECR repository creation templates, Terraform, and a migration tool to make secure-by-default the path of least resistance.