Back to Checks
aws

ECR repository has a lifecycle policy configured

ecr_repositories_lifecycle_policy_enabled
Service: ecrSeverity: low
OfficialBuilt-inVerified
Categories:container-security
Resource Type:AwsEcrRepository

Amazon ECR repositories have a lifecycle policy configured to automatically expire container images based on age, count, or tags.

Prowler logoProwlerprowler-provider-aws

Risk

Without lifecycle policies, images accumulate indefinitely, leading to:

  • Availability issues when quotas block pushes and CI/CD
  • Integrity risk from redeploying outdated, vulnerable images
  • Cost growth from unnecessary storage

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecr_repositories_lifecycle_policy_enabled

Recommendation

Implement lifecycle policies per repository to expire untagged, old, or excess images and retain a small set of trusted releases. Validate outcomes before applying, review rules regularly, and apply consistently across Regions when replicating. This supports defense in depth by reducing image attack surface and operational risk.

Remediation

CLI

aws ecr put-lifecycle-policy --repository-name <REPOSITORY_NAME> --lifecycle-policy-text '{"rules":[{"rulePriority":1,"selection":{"tagStatus":"untagged","countType":"imageCountMoreThan","countNumber":1},"action":{"type":"expire"}}]}'

Terraform

resource "aws_ecr_lifecycle_policy" "<example_resource_name>" {
  repository = "<example_resource_name>"
  # Critical: The policy ensures a lifecycle policy is configured for the repo
  policy = <<POLICY
{"rules":[{"rulePriority":1,"selection":{"tagStatus":"untagged","countType":"imageCountMoreThan","countNumber":1},"action":{"type":"expire"}}]}
POLICY
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ECR::Repository
    Properties:
      # Critical: Adding a lifecycle policy makes the repo PASS this check
      LifecyclePolicy:
        # Critical: The policy content; any valid rule satisfies the requirement
        LifecyclePolicyText: >-
          {"rules":[{"rulePriority":1,"selection":{"tagStatus":"untagged","countType":"imageCountMoreThan","countNumber":1},"action":{"type":"expire"}}]}

Other

1Open the AWS Console and go to Amazon ECR > Repositories
2Select the target repository
3From Actions, choose "Lifecycle policies"
4Click "Create rule"
5Set Image status: Untagged, Match criteria: Image count more than = 1, Action: Expire
6Click "Save" to apply the lifecycle policy

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecr.ecr_client import ecr_client


class ecr_repositories_lifecycle_policy_enabled(Check):
    def execute(self):
        findings = []
        for registry in ecr_client.registries.values():
            for repository in registry.repositories:
                report = Check_Report_AWS(metadata=self.metadata(), resource=repository)
                report.status = "FAIL"
                report.status_extended = f"Repository {repository.name} does not have a lifecycle policy configured."
                if repository.lifecycle_policy:
                    report.status = "PASS"
                    report.status_extended = f"Repository {repository.name} has a lifecycle policy configured."

                findings.append(report)

        return findings

References