Agreed - this is also a good option.

The main downsides I see are:

(1) It would affect people's Docker workflow

docker pull org/foo:tag

->

aws ecr get-login

<run docker login command>

docker pull some-aws-url/foo:tag

(2) We need to keep some history (to allow rolling back apps). So either need that in DockerHub or would need to move old images to ECR if we planned to fully nuke our DockerHub account.