ECR repositories should have at least one lifecycle policy configured

How to fix it

• Can't be undone: Images a rule expires are deleted within 24 hours and cannot be recovered, so run the rules as test rules first to preview what they match.
• Can break clients: A task or node that pulls an expired image by its digest then fails to start, so keep any image still deployed out of the rule's match.

In the console

Elastic Container Registry → Private registry → Repositories → the repository → Lifecycle policies

Rule priority

1

Image status

Untagged, so only images no tag refers to are expired

Match criteria

Days since image created, such as 14

Rule action

Expire

With the AWS CLI

aws ecr put-lifecycle-policy --repository-name <repository-name> --lifecycle-policy-text '{"rules":[{"rulePriority":1,"description":"Expire untagged images after 14 days","selection":{"tagStatus":"untagged","countType":"sinceImagePushed","countUnit":"days","countNumber":14},"action":{"type":"expire"}}]}' --region <region>

With Terraform

resource "aws_ecr_lifecycle_policy" "this" {
  repository = var.repository_name

  policy = jsonencode({
    rules = [{
      rulePriority = 1
      description  = "Expire untagged images after 14 days"
      selection = {
        tagStatus   = "untagged"
        countType   = "sinceImagePushed"
        countUnit   = "days"
        countNumber = 14
      }
      action = {
        type = "expire"
      }
    }]
  })
}