[ECR] [AmazonLinux]: Build a new image of amazonlinux as soon as ECR Scan would find vulnerabilities

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Disclaimer** I guess that Amazon Linux is its own team, one hopes this will reach whoever can make a change

**Tell us about your request**
As an amazonlinux (1/2, mostly 2) user, I build docker images almost exclusively based on the images coming from Public ECR.
Given that AWS ECR can scan images and has notifications on security findings, can we get the AmazonLinux team to publish by themselves new images with the latest security fixes when vulnerabilities are found.

Nearly none of our images we use make it passed 2 weeks before a security vulnerability issue is found and we have aggressive remediation timelines.

However, the crux of the issue is that, even with running the most aggressive yum upgrade and cleanup, this still results into a new docker layer with the OS deps changed. For a 20MB worth of updates to a 89MB new layer

```
FROM public.ecr.aws/amazonlinux/amazonlinux:2
RUN yum upgrade -y;\
find /var/tmp -name "*.rpm" -print -delete ;\
find /tmp -name "*.rpm" -print -delete ;\
yum autoremove -y; \
yum clean packages; yum clean headers; yum clean metadata; yum clean all; rm -rfv /var/cache/yum

```
Results into

```bash
[john@john-workstation]$ docker history b383f743617b
IMAGE CREATED CREATED BY SIZE COMMENT
b383f743617b About a minute ago /bin/sh -c yum upgrade -y; find /var/tmp … 89MB
3b6649ff98f5 4 months ago /bin/sh -c #(nop) CMD ["/bin/bash"] 0B
4 months ago /bin/sh -c #(nop) ADD file:a822007c4e0f482d6… 163MB

```

**Which service(s) is this request for?**
This could be ECR/Amazon Linux

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

By getting images published from source regularly by the Amazon Linux team into AWS ECR, I do not need to have images adding up a whole new layer just to get packages updated which is required for security and compliance.

Having to do so only makes images bigger although one tries to keep docker images to the smallest possible.

If anyone from the community has a workaround I would love to know how this was solved.

This is a roadmap request involving Amazon ECR and Amazon Linux image publication; the payload names no repository files, tests, or implementation entry points. Start by determining which AWS team or service owns Amazon Linux image builds and ECR vulnerability notifications. Done would mean a documented, agreed workflow for publishing updated images when scans find vulnerabilities.

Written by the indexing model from the issue text.