Back to Checks
aws

ECR repository has image tag immutability enabled

ecr_repositories_tag_immutability
Service: ecrSeverity: medium
OfficialBuilt-inVerified
Categories:container-security
Resource Type:AwsEcrRepository

Amazon ECR repositories are assessed for image tag immutability. Repositories permitting tag updates (MUTABLE) are identified; those enforcing immutable tags (such as IMMUTABLE) are recognized.

Prowler logoProwlerprowler-provider-aws

Risk

Mutable tags allow replacing the image behind a trusted tag, undermining release integrity. This enables supply-chain injection, unintended rollouts, and backdoored deployments, harming availability. Malicious images can exfiltrate data, impacting confidentiality.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecr_repositories_tag_immutability

Recommendation

Enable tag immutability so tags map to a single artifact. Use versioned tags per build, block retagging in CI/CD, and apply least privilege for push actions. Layer image signing and admission controls to run only trusted images. If exceptions are needed, keep them narrow and monitored.

Remediation

CLI

aws ecr put-image-tag-mutability --repository-name <repository-name> --image-tag-mutability IMMUTABLE

Terraform

resource "aws_ecr_repository" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  image_tag_mutability = "IMMUTABLE" # Critical: enables tag immutability to prevent tag overwrites
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ECR::Repository
    Properties:
      ImageTagMutability: IMMUTABLE  # Critical: enables tag immutability to prevent tag overwrites

Other

1Open the Amazon ECR console
2Go to Repositories (Private) and select the repository
3Click Actions > Edit
4Set Image tag immutability to Immutable
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecr.ecr_client import ecr_client


class ecr_repositories_tag_immutability(Check):
    def execute(self):
        findings = []
        for registry in ecr_client.registries.values():
            for repository in registry.repositories:
                report = Check_Report_AWS(metadata=self.metadata(), resource=repository)

                report.status = "PASS"
                report.status_extended = (
                    f"Repository {repository.name} has immutability configured."
                )

                if repository.immutability == "MUTABLE":
                    report.status = "FAIL"
                    report.status_extended = f"Repository {repository.name} does not have immutability configured."

                findings.append(report)

        return findings

References