Best practice for a container lifecycle age?

https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html

Personally this should be based on your companies security strategy.

A Regular scanning strategy of your ECR should be put in place paired with AWS inspector.

Vulnerabilities are being discovered on a daily basis and should be monitored closely.

Containers should be patched based off when vulnerabilities are discovered. Depending on the CVE score and the impact may dictate how urgent you should deploy a patched version.

Regular patching is good practice in my eyes. Time is normally against most people to review release notes for every package in a container and many mainly rely on the likes of inspector,qualys, tenable etc container scanning.