Homepage

ECR Repository Missing Lifecycle Policy Affecting ECR service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Lifecycle

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00755
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Enabling a lifecycle policy on an ECR repository ensures that images are managed efficiently by defining rules to clean up unused images, which reduces the risk of reaching storage limits and helps in cost management. Without a lifecycle policy, there is no automated way to manage the retention of images, which can lead to storage bloat, increased costs, and potential exposure of old and possibly vulnerable images.

How to fix?

Set repository attribute in aws_ecr_lifecycle_policy resource to a valid aws_ecr_repository name.

Example Configuration


resource "aws_ecr_repository" "allow1" {
  name = "snyk-repository1"
}

resource "aws_ecr_lifecycle_policy" "allow1_policy" {
  repository = aws_ecr_repository.allow1.name

  policy = <<EOF
{
    "rules": [
        {
            "rulePriority": 1,
            "description": "Expire images older than 14 days",
            "selection": {
                "tagStatus": "untagged",
                "countType": "sinceImagePushed",
                "countUnit": "days",
                "countNumber": 14
            },
            "action": {
                "type": "expire"
            }
        }
    ]
}
EOF
}