All checks
Medium
ECR private repositories should have tag immutability configured
Checks that the private ECR repository's tags are immutable, so a tag always names the same image and a push cannot replace an image already deployed under it. Immutable with tag exclusions fails, as in AWS's control. AWS advises keeping pull through cache repositories mutable so cached images can update.
- service
- ECR
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: Pushing a tag the repository already holds, such as latest, then fails with ImageTagAlreadyExistsException, so give each build its own tag.
In the console
Elastic Container Registry → Private registry → Repositories → the repository → Edit
- Image tag immutability
- Immutable, with the Immutable tag exclusion box left empty
With the AWS CLI
aws ecr put-image-tag-mutability --repository-name <repository-name> --image-tag-mutability IMMUTABLE --region <region>With Terraform
resource "aws_ecr_repository" "this" {
name = var.repository_name
image_tag_mutability = "IMMUTABLE"
}See which of your accounts this check is failing on.
Book a live scan