Description

Ensure that Amazon Elastic Container Registry (ECR) repositories have Tag immutability enabled, so that an existing image tag (such as latest or a version tag) cannot be overwritten with a different image after it has been pushed.

Rationale

Without tag immutability, an image tag can be silently overwritten, meaning a tag that a deployment pipeline or Kubernetes manifest references (such as v1.2.3) could later point to entirely different image content, whether due to human error, a compromised CI/CD pipeline, or a malicious actor with push access. This undermines the ability to reliably trace which exact image was deployed and can be used to smuggle malicious content into a trusted-looking tag. Enabling tag immutability ensures a given tag always refers to the same, original image content once pushed.

Impact

  • Ensures a given image tag always refers to the same, immutable image content once pushed

  • Improves traceability and trust in the deployment pipeline's image references

  • Requires pushing a new, distinct tag for every new image build, rather than overwriting an existing tag

Default Value

Tag immutability is disabled (Mutable) by default for newly created ECR repositories.

Pre-Requisites

  • IAM permissions to update repository settings (ecr:PutImageTagMutability)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ECR > Repositories.

  3. Select the repository to review.

  4. Review the Image tag mutability setting.

  5. Verify that it shows as Immutable.

  6. If the setting shows as Mutable, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ECR > Repositories and select the repository to update.

  3. Select Edit.

  4. Under Image tag mutability, select Immutable.

  5. Save the changes.

  6. Verify the repository details now show Image tag mutability as Immutable, and update CI/CD pipelines to push uniquely named tags for each build going forward.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ECR > Repositories and select the affected repository.

  3. Select Edit.

  4. Under Image tag mutability, select Mutable.

  5. Save the changes.

Reference