Check provider logo

ECR repository has a lifecycle policy configured

ecr_repositories_lifecycle_policy_enabled

Severitylow
Serviceecr
by Prowler
container-security

Amazon ECR repositories have a lifecycle policy configured to automatically expire container images based on age, count, or tags.

Risk

Without lifecycle policies, images accumulate indefinitely, leading to:

  • Availability issues when quotas block pushes and CI/CD
  • Integrity risk from redeploying outdated, vulnerable images
  • Cost growth from unnecessary storage
Run this check with Prowler CLI

prowler aws --checks ecr_repositories_lifecycle_policy_enabled

Run in Prowler Cloud

Recommendation

Implement lifecycle policies per repository to expire untagged, old, or excess images and retain a small set of trusted releases. Validate outcomes before applying, review rules regularly, and apply consistently across Regions when replicating. This supports defense in depth by reducing image attack surface and operational risk.

Remediation

CLI

aws ecr put-lifecycle-policy --repository-name <REPOSITORY_NAME> --lifecycle-policy-text '{"rules":[{"rulePriority":1,"selection":{"tagStatus":"untagged","countType":"imageCountMoreThan","countNumber":1},"action":{"type":"expire"}}]}'

Native IaC
Terraform
Other
  1. Open the AWS Console and go to Amazon ECR > Repositories
  2. Select the target repository
  3. From Actions, choose "Lifecycle policies"
  4. Click "Create rule"
  5. Set Image status: Untagged, Match criteria: Image count more than = 1, Action: Expire
  6. Click "Save" to apply the lifecycle policy

Source Code

Resource Type

AwsEcrRepository

References