ECR Image Scanning and Lifecycle Policies

Amazon ECR image scanning automatically inspects container images for known software vulnerabilities. When you push an image to a repository, ECR can trigger a scan using a Common Vulnerabilities and Exposures (CVE) database. The scan identifies packages in the image that have known vulnerabilities and reports them with severity levels (CRITICAL, HIGH, MEDIUM, LOW, UNSPECIFIED). The exam expects you to know the two scanning types: Basic scanning and Enhanced scanning.

Example CLI command to initiate a scan:

aws ecr start-image-scan --repository-name my-repo --image-id imageTag=latest

Example to retrieve findings:

aws ecr describe-image-scan-findings --repository-name my-repo --image-id imageTag=latest

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Expire images older than 14 days",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countNumber": 14,
        "countUnit": "DAYS"
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Keep only 5 tagged images with prefix 'prod-'",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["prod-"],
        "countType": "imageCountMoreThan",
        "countNumber": 5
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}

aws ecr put-image-scanning-configuration --repository-name my-repo --image-scanning-configuration scanOnPush=true

Put lifecycle policy:

aws ecr put-lifecycle-policy --repository-name my-repo --lifecycle-policy-text file://policy.json

Get lifecycle policy:

aws ecr get-lifecycle-policy --repository-name my-repo

aws ecr list-images --repository-name my-repo

Describe image (including scan status):

aws ecr describe-images --repository-name my-repo

Get scan findings:

aws ecr describe-image-scan-findings --repository-name my-repo --image-id imageTag=latest

A large e-commerce company runs a microservices architecture with hundreds of services. They use AWS CodePipeline to build and deploy Docker images. They need to ensure no image with critical vulnerabilities reaches production. They enable enhanced scanning on all repositories and integrate scan results with EventBridge. A Lambda function subscribes to scan completion events; if any CRITICAL vulnerability is found, it automatically updates the image tag to 'blocked' and sends a notification to the security team. The pipeline is configured to only deploy images tagged 'passed-scan'. This ensures that only safe images are deployed. They also use lifecycle policies to automatically delete images older than 90 days for all tags except 'latest' and 'stable', saving storage costs. A common mistake is forgetting to enable scanning on push for new repositories, which leads to un-scanned images in production. They solved this by using AWS Config rules to enforce scanning on push at the account level.

A financial services firm must comply with PCI DSS, which requires vulnerability scanning of all container images. They use a centralized security account with Amazon Inspector to aggregate findings from all member accounts. They enable enhanced scanning at the organization level via AWS Organizations. Lifecycle policies are applied to each repository to expire untagged images after 7 days (since untagged images often result from failed builds). They also retain only the last 10 images per tag prefix (e.g., 'prod-') to limit audit scope. A challenge they faced: lifecycle policies did not run immediately after a security incident, so they had to manually trigger image expiration using a script that calls batch-delete-image. They learned that lifecycle policies are not suitable for immediate cleanup; for urgent removal, direct API calls are needed.

A startup uses ECR for development and testing. Developers push many images daily, causing storage costs to balloon. They implement a lifecycle policy that expires all images older than 30 days for tags with prefix 'dev-' and keeps only the last 3 images for each branch. For untagged images (often from intermediate builds), they expire after 1 day. This reduced storage costs by 70%. They also use basic scanning to catch obvious vulnerabilities early. A common misconfiguration: setting countNumber too low for imageCountMoreThan accidentally deletes all images. They learned to test policies using get-lifecycle-policy-preview API to simulate what would be deleted.