ECR image tagging

Question

I understand that as a security best practice, tagging should be immutable. The images I have set-up are tagged with build number, Sha, and environment variables(dev/uat). Given this, the environment tag will be repeated for all the images within the same environment.

Questions:

1. Is it possible to handle this repetitive tagging with ECR tagging to be immutable?
2. If the tagging is changed to mutable, how does ECR identify the `latest` image? Does it need an explicit `latest` tagging? This is to be run in EKS later.

Thanks!

Accepted Answer

1. ECR tagging can be mutable/immutable. The best practice is to use immutable tagging.
2. You need to explicitly tag it with "latest" tag.

Answer

Hi,

Based on https://repost.aws/questions/QUN4A5R47CTcGifcCr6mWCnQ/ecr-image-tagging, you want to make your repository globally immutable by using

```
aws ecr create-repository --repository-name name --image-tag-mutability IMMUTABLE --region us-east-2
```

Then, just before you add a new image, you make the last image mutable via

```
aws ecr put-image-tag-mutability --repository-name name --image-tag-mutability MUTABLE --region us-east-2
```

Then your remove the tag `'latest'`  on it and switch it back to IMMUTABLE. Then, you add your latest version of the image with all tags you want + `'latest'`

Best,

Didier

ECR image tagging

Relevant content