ECR repository has image tag immutability enabled

Check ID: ecr_repositories_tag_immutability
Provider: AWS
Service: ecr
Severity: MEDIUM
Categories: container-security
Resource type: AwsEcrRepository

What this check verifies

Amazon ECR repositories are assessed for image tag immutability. Repositories permitting tag updates (MUTABLE) are identified; those enforcing immutable tags (such as IMMUTABLE) are recognized.

Risk

Mutable tags allow replacing the image behind a trusted tag, undermining release integrity. This enables supply-chain injection, unintended rollouts, and backdoored deployments, harming availability. Malicious images can exfiltrate data, impacting confidentiality.

Recommendation

Enable tag immutability so tags map to a single artifact. Use versioned tags per build, block retagging in CI/CD, and apply least privilege for push actions. Layer image signing and admission controls to run only trusted images. If exceptions are needed, keep them narrow and monitored.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecr put-image-tag-mutability —repository-name <repository-name> —image-tag-mutability IMMUTABLE

resource "aws_ecr_repository" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  image_tag_mutability = "IMMUTABLE" # Critical: enables tag immutability to prevent tag overwrites
}

Resources:
  <example_resource_name>:
    Type: AWS::ECR::Repository
    Properties:
      ImageTagMutability: IMMUTABLE  # Critical: enables tag immutability to prevent tag overwrites

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecr_repositories_tag_immutability. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECR latest image has no vulnerabilities above the threshold ECS cluster has Container Insights enabled or enhanced

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires