ECR Lifecycle policy

Question

I created below life cycle policy for ECR
But all images other than latest 20 get expired.
I want to keep latest 20 and the images within 6 month.
to be clear - there can be more images than 20 if they ar within last six month

```
{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Latest",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": [
          "latest"
        ],
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 9999
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Keep 20 most recent images",
      "selection": {
        "tagStatus": "tagged",
        "tagPatternList": [
          "*"
        ],
        "countType": "imageCountMoreThan",
        "countNumber": 20
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 3,
      "description": "Expire all images older than 180 days",
      "selection": {
        "tagStatus": "any",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 1800
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}```

and also we cant have two rules with tagStatus with any

Praveen Muppala · Accepted Answer

Yes, you're right — in your current setup, if **all 20 latest tagged images are older than 180 days**, they **will still be expired** due to the `sinceImagePushed > 180 days` rule.

This happens because **Amazon ECR lifecycle rules are evaluated in order of priority**, and **once a rule matches, it's applied immediately** — even if a later rule would have preserved the image.

Praveen Muppala · Answer

Hello,

**⚠ Issues in Your Current Policy:**

**Contradictory rules:**

* rulePriority: 2 expires images if count > 20 — this is causing deletion of images even if they’re within 180 days.
* rulePriority: 3 tries to expire images older than 1800 days — seems like a typo (should be 180 days).
* tagStatus: any used in multiple rules – AWS only allows one rule with tagStatus: any in a lifecycle policy.

To retain the **latest 20 images** and **all images pushed within the last 180 days** in Amazon ECR, structure your lifecycle policy using the following rules:

```json
{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Expire untagged images older than 180 days",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 180
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Expire tagged images older than 180 days",
      "selection": {
        "tagStatus": "tagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 180
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 3,
      "description": "Retain the 20 most recent tagged images",
      "selection": {
        "tagStatus": "tagged",
        "countType": "imageCountMoreThan",
        "countNumber": 20
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}
```

This setup ensures:

* Images pushed in the last 180 days are preserved.
* At least 20 recent tagged images are kept, even if older than 180 days.
* Untagged images older than 180 days are expired.

Note: Amazon ECR allows only one rule with `tagStatus: any`, so separate rules for `tagged` and `untagged` are necessary.

For more information, refer to the official [Amazon ECR Lifecycle Policy documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html).

ECR Lifecycle policy

Add your answer

Relevant content