ECR Registry allows mutable tags Affecting ECR service in AWS

Severity Framework Snyk CCSS

Rule category Containers / Images

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Frameworks

Description

The AWS ECR registry does not enforce immutable tags.

Set image_tag_mutability attribute to IMMUTABLE.

resource "aws_ecr_repository" "ecr_repo" {
  name                 = "test"
  image_tag_mutability = "IMMUTABLE"
}