ECR repository has a lifecycle policy configured

Check ID: ecr_repositories_lifecycle_policy_enabled
Provider: AWS
Service: ecr
Severity: LOW
Categories: container-security
Resource type: AwsEcrRepository

What this check verifies

Amazon ECR repositories have a lifecycle policy configured to automatically expire container images based on age, count, or tags.

Risk

Without lifecycle policies, images accumulate indefinitely, leading to:

Availability issues when quotas block pushes and CI/CD
Integrity risk from redeploying outdated, vulnerable images
Cost growth from unnecessary storage

Recommendation

Implement lifecycle policies per repository to expire untagged, old, or excess images and retain a small set of trusted releases. Validate outcomes before applying, review rules regularly, and apply consistently across Regions when replicating. This supports defense in depth by reducing image attack surface and operational risk.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecr put-lifecycle-policy --repository-name <REPOSITORY_NAME> --lifecycle-policy-text '{"rules":[{"rulePriority":1,"selection":{"tagStatus":"untagged","countType":"imageCountMoreThan","countNumber":1},"action":{"type":"expire"}}]}'

resource "aws_ecr_lifecycle_policy" "<example_resource_name>" {
  repository = "<example_resource_name>"
  # Critical: The policy ensures a lifecycle policy is configured for the repo
  policy = <<POLICY
{"rules":[{"rulePriority":1,"selection":{"tagStatus":"untagged","countType":"imageCountMoreThan","countNumber":1},"action":{"type":"expire"}}]}
POLICY
}

Resources:
  <example_resource_name>:
    Type: AWS::ECR::Repository
    Properties:
      # Critical: Adding a lifecycle policy makes the repo PASS this check
      LifecyclePolicy:
        # Critical: The policy content; any valid rule satisfies the requirement
        LifecyclePolicyText: >-
          {"rules":[{"rulePriority":1,"selection":{"tagStatus":"untagged","countType":"imageCountMoreThan","countNumber":1},"action":{"type":"expire"}}]}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecr_repositories_lifecycle_policy_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECR registry scans images on push in all repositories ECR repository is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires