Skip to content

ECR repositories should have at least one lifecycle policy configured

Identifier

ecr-configure-private-lifecycle-policy

Category

Identify > Resource configuration

Description

This control checks whether Amazon Elastic Container Registry (ECR) private repositories have lifecycle policies configured. Lifecycle policies help manage image storage by automatically expiring unused or old container images. This reduces costs, improves organization, and lowers the risk of deploying outdated images. The check verifies that a aws_ecr_lifecycle_policy resource is associated with each aws_ecr_repository.

Non Compliant Example

Terraform
1
2
3
4
5
6
resource "aws_ecr_repository" "foo" {
    name = "foo"
    image_scanning_configuration {
        scan_on_push = true
    }
}

Remediation

To fix this violation, define a lifecycle policy using the aws_ecr_lifecycle_policy resource. For example, retain only the 10 most recent images tagged with "prod" and expire untagged images after 14 days:

Terraform
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
resource "aws_ecr_repository" "foo" {
    name = "foo"
    image_scanning_configuration {
        scan_on_push = true
    }
}
resource "aws_ecr_lifecycle_policy" "foo_policy" {
    repository = aws_ecr_repository.foo.name

    policy = <<EOF
    {
    "rules": [
        {
            "rulePriority": 1,
            "description": "Keep last 30 images",
            "selection": {
                "tagStatus": "tagged",
                "tagPrefixList": ["v"],
                "countType": "imageCountMoreThan",
                "countNumber": 30
            },
            "action": {
                "type": "expire"
            }
        }
    ]
    }
    EOF
    ...
}

Extra Resources