Skip to main content

⭐ Repository → 📁 Compliance Engine → 📁 CloudAware → 📁 AWS → 📁 ECR

🛡️ AWS ECR Repository Lifecycle Policy is not configured🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-9a0607d91

Description​

Open File

Description​

This policy identifies AWS ECR Repositories that do not have a lifecycle policy configured. A lifecycle policy is a set of rules that automates the management of images in a repository, helping to clean up old or unused images.

Rationale​

Configuring a lifecycle policy is a best practice for managing container images in ECR. It helps to:

  • Reduce Storage Costs: Automatically removes old or untagged images, preventing them from accumulating and incurring unnecessary storage charges.
  • Improve Repository Hygiene: Keeps repositories clean and makes it easier to find relevant images.
  • Avoid Hitting Service Quotas: Prevents reaching the maximum number of images allowed per repository.

Audit​

This policy flags an AWS ECR Repository as INCOMPLIANT if its Lifecycle Policy Text JSON is empty.

Remediation​

Open File

Remediation​

Configure Lifecycle Policy​

Create and apply a lifecycle policy to your Amazon ECR repository. A lifecycle policy contains one or more rules that define the cleanup actions for the images in your repository.

From AWS CLI​

  1. Create a JSON file named {{lifecycle-policy}}.json with the rules for your policy. For example:

    {
        "rules": [
            {
                "rulePriority": 1,
                "description": "Expire images older than 14 days",
                "selection": {
                    "tagStatus": "untagged",
                    "countType": "sinceImagePushed",
                    "countUnit": "days",
                    "countNumber": 14
                },
                "action": {
                    "type": "expire"
                }
            }
        ]
    }

  2. Apply the lifecycle policy to your repository:

    aws ecr put-lifecycle-policy \
        --repository-name {{repository-name}} \
        --lifecycle-policy-text file://{{lifecycle-policy}}.json

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 16c information security operations and administration;44no data
💼 APRA CPG 234 → 💼 36h patch management controls — to manage the assessment and application of patches and other updates that address known vulnerabilities in a timely manner;77no data
💼 APRA CPG 234 → 💼 40 An important aspect of information asset life-cycle management involves minimising vulnerabilities and maintaining support. Information security exposures could arise from hardware and software which is outdated or has limited or no support (whether through a third party, a related party or in-house). Technology that is end-of-life5 , out-of-support or in extended support is typically less secure by design, has a dated security model and can take longer, or is unable, to be updated to address new threats.77no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECR.3] ECR repositories should have at least one lifecycle policy configured11no data
💼 Cloudaware Framework → 💼 Resource Optimization24no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3128no data
💼 FedRAMP High Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)16no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)27no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)328no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)16no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks23no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration727no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2(2) Baseline Configuration _ Automation Support for Accuracy and Currency16no data