The UI on ECR does not let you apply tags to images. When you push images to ECR that have a tag that exists, the existing image becomes untagged, as expected. However, there does not appear to be a way to download untagged images. For example, I can't simply download the image hash
docker pull myarn.amazonaws.com/sandbox:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365
Error response from daemon: manifest for myarn.amazonaws.com/sandbox:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365 not found
So I discovered a user-unfriendly way of doing this. You first tag an untagged image, then you can download it. Here I tag an untagged image to backup
MANIFEST=$(aws ecr batch-get-image --repository-name sandbox --image-ids imageDigest=sha256:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365 --query 'images[].imageManifest' --output text)
aws ecr put-image --repository-name sandbox --image-tag backup --image-manifest "$MANIFEST"
Then I can download it as normal
docker pull myarn.amazonaws.com/sandbox:backup