ECR repository has image tag immutability enabled
ecr_repositories_tag_immutability
Amazon ECR repositories are assessed for image tag immutability. Repositories permitting tag updates (MUTABLE) are identified; those enforcing immutable tags (such as IMMUTABLE) are recognized.
Risk
Mutable tags allow replacing the image behind a trusted tag, undermining release integrity. This enables supply-chain injection, unintended rollouts, and backdoored deployments, harming availability. Malicious images can exfiltrate data, impacting confidentiality.
prowler aws --checks ecr_repositories_tag_immutability
Recommendation
Enable tag immutability so tags map to a single artifact. Use versioned tags per build, block retagging in CI/CD, and apply least privilege for push actions. Layer image signing and admission controls to run only trusted images. If exceptions are needed, keep them narrow and monitored.
Remediation
aws ecr put-image-tag-mutability --repository-name <repository-name> --image-tag-mutability IMMUTABLE
- Open the Amazon ECR console
- Go to Repositories (Private) and select the repository
- Click Actions > Edit
- Set Image tag immutability to Immutable
- Click Save
Source Code
Resource Type
AwsEcrRepository