---
title: "Ensure ECR image tags are immutable"
canonical: "https://kb.cynergy.app/space/MD/991756814/Ensure%20ECR%20image%20tags%20are%20immutable"
format: markdown
---
Cynergy Policy ID: CYN_AWS_GENERAL_24  
Severity: LOW

# ECR image tags are not immutable

# Description

Amazon ECR supports immutable tags, preventing image tags from being overwritten. In the past, ECR tags could have been overwritten, this could be overcome by requiring users to uniquely identify an image using a naming convention.

Tag Immutability enables users can rely on the descriptive tags of an image as a mechanism to track and uniquely identify images. By setting an image tag as immutable, developers can use the tag to correlate the deployed image version with the build that produced the image.

# Fix - Runtime

## AWS Console

To change the policy using the AWS Console, follow these steps:

1. Log in to the AWS Management Console at <u>[https://console.aws.amazon.com/](https://console.aws.amazon.com/)</u>.
2. Open the <u>**[Amazon ECR console](https://console.aws.amazon.com/ecr/repositories)**</u>.
3. Select a repository using the radio button.
4. Click **Edit**.
5. Enable the **Tag immutability** toggle.

## CLI Command

To create a repository with immutable tags configured:

Shell

```
aws ecr create-repository
--repository-name name
--image-tag-mutability IMMUTABLE
--region us-east-2

```

# Fix - Build time

## Terraform

- **Resource**: aws_ecr_repository
- **Arguments**: image_tag_mutability - (Optional) The tag mutability setting for the repository. Must be one of: MUTABLE or IMMUTABLE. Defaults to MUTABLE.

Go

```go
resource "aws_ecr_repository" "example" {
  ...
  name                 = "bar"
+ image_tag_mutability = "IMMUTABLE"
}

```

## CloudFormation

- **Resource**: AWS::ECR::Repository
- **Arguments**: Properties.ImageTagMutability - (Optional) The tag mutability setting for the repository. Must be one of: MUTABLE or IMMUTABLE. Defaults to MUTABLE.

YAML

```yaml
Resources: 
  MyRepository: 
    Type: AWS::ECR::Repository
    Properties: 
      ...
+     ImageTagMutability: "IMMUTABLE"

```