[service] [request]: Allow ECR lifecycle policies to account for image re-tagging to prevent premature image expiration
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Enable Amazon ECR lifecycle policies to correctly account for re-tagging of existing images when determining image age. Lifecycle evaluation should provide a way to treat adding a new tag to an already-pushed image as a meaningful event, so recently re-tagged images are not expired solely based on their original manifest push time.
**Which service(s) is this request for?**
ECR
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We use a CI/CD promotion model where a container image is built once and promoted across environments by applying additional tags to the same immutable image manifest. At the same time, we want to enforce an aggressive ECR lifecycle policy to automatically remove genuinely stale images.
Currently, ECR lifecycle policies evaluate image age exclusively using the imagePushedAt timestamp, which reflects only the original manifest push. When an existing image is re-tagged, the tag is updated but the image age used by lifecycle evaluation does not change.
This creates a critical failure mode:
- An image receives a new tag after promotion
- The lifecycle policy evaluates the image as “old” based on its original push time
- The image is expired and deleted shortly after the new tag is created
When this happens, environments that reference the newly created tag can fail because the underlying image no longer exists. This can surface as missing images in production, failed deployments, or unexpected runtime pull errors.
As a result:
- Aggressive lifecycle rules cannot be safely used with re-tag-based promotion
- Image immutability and promotion workflows are undermined
- Production stability is put at risk due to premature image deletion
**Are you currently working around this issue?**
Currently working on a solution, but the available workarounds are operationally expensive.
- Weakening or disabling lifecycle policies, leading to uncontrolled repository growth
**Additional context**
**Attachments**
Contributor guide
Research direction
Start by reviewing the ECR lifecycle policy behavior described in the issue, especially how imagePushedAt is used when an existing manifest receives a new tag. Determine the expected treatment of re-tagging for lifecycle evaluation and verify that promoted images are not expired solely because of their original push time.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, devops
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100