ECR repository must have immutable image tags

Medium AWS General aws-ecr-repository-immutability

Applies to

AWS::ECR::Repository

What CGPulse checks

A resource passes this rule when imageTagMutability must equal IMMUTABLE. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Set image tag mutability to IMMUTABLE to prevent tag overwrites and ensure deployment integrity. In AWS Console: ECR > Repositories > select repo > Edit > Tag immutability > Enabled. See: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html

CLI

aws ecr put-image-tag-mutability --repository-name "{name}" --image-tag-mutability IMMUTABLE

Terraform

resource "aws_ecr_repository" "{name}" {
  image_tag_mutability = "IMMUTABLE"
}

Compliance frameworks

Cloud Security: AWS Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan