ECR image tags are not immutable misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_51
Category - Subcategory	Storage - Versioning
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Amazon ECR supports immutable tags, preventing image tags from being overwritten.

Tag immutability enables users to rely on the descriptive tags of an image as a mechanism to track and uniquely identify images.

By setting an image tag as immutable, developers can use the tag to correlate the deployed image version with the build that produced the image.

How to Fix

Resource: AWS::ECR::Repository

• Arguments: Properties.ImageTagMutability - (Optional) The tag mutability setting for the repository. Must be one of: MUTABLE or IMMUTABLE. Defaults to MUTABLE. [source,go]

---

Resources: MyRepository: Type: AWS::ECR::Repository Properties: ...

• ImageTagMutability: "IMMUTABLE"

---