I understand that as a security best practice, tagging should be immutable. The images I have set-up are tagged with build number, Sha, and environment variables(dev/uat). Given this, the environment tag will be repeated for all the images within the same environment. Questions: 1. Is it possible to handle this repetitive tagging with ECR tagging to be immutable? 2. If the tagging is changed to mutable, how does ECR identify the `latest` image? Does it need an explicit `latest` tagging? This is to be run in EKS later. Thanks!

1. ECR tagging can be mutable/immutable. The best practice is to use immutable tagging. 2. You need to explicitly tag it with "latest" tag.

ECR image tagging

I understand that as a security best practice, tagging should be immutable. The images I have set-up are tagged with build number, Sha, and environment variables(dev/uat). Given this, the environment tag will be repeated for all the images within the same environment.

Questions:

Is it possible to handle this repetitive tagging with ECR tagging to be immutable?
If the tagging is changed to mutable, how does ECR identify the latest image? Does it need an explicit latest tagging? This is to be run in EKS later.

Thanks!

トピック

コンテナ

タグ

Amazon Elastic Container レジストリ (ECR)コンテナタグ付け

言語

English

Dev-TVX

質問済み 9ヶ月前2162ビュー

2回答

新しい順
投票が多い順
コメントが多い順

Hi,

Based on https://repost.aws/questions/QUN4A5R47CTcGifcCr6mWCnQ/ecr-image-tagging, you want to make your repository globally immutable by using

aws ecr create-repository --repository-name name --image-tag-mutability IMMUTABLE --region us-east-2

Then, just before you add a new image, you make the last image mutable via

aws ecr put-image-tag-mutability --repository-name name --image-tag-mutability MUTABLE --region us-east-2

Then your remove the tag 'latest' on it and switch it back to IMMUTABLE. Then, you add your latest version of the image with all tags you want + 'latest'

Best,

Didier