ECR Registry allows mutable tags Affecting ECR service in AWS


Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    Containers / Images

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
  • Snyk ID SNYK-CC-00344
  • credit Snyk Research Team

Description

The AWS ECR registry does not enforce immutable tags.

How to fix?

Set image_tag_mutability attribute to IMMUTABLE.

Example Configuration

resource "aws_ecr_repository" "ecr_repo" {
  name                 = "test"
  image_tag_mutability = "IMMUTABLE"
}

Terraform