Lifecycle Policy in Use

01 Sign in to AWS Management Console.

02 Navigate to Amazon ECR console at https://console.aws.amazon.com/ecr.

03 In the navigation panel, under Amazon ECR, select Repositories to access your ECR image repositories.

04 Click on name of the image repository that you want to examine, available in the Repository name column.

05 In the left navigation panel, under Repositories, choose Lifecycle Policy to access the lifecycle policies associated with the selected repository.

06 On the Lifecycle Policy page, check for any policy rules listed in the Lifecycle policy rules section:

1. If there are no rules listed in this section, instead the following message is displayed: "No lifecycle policies to display", there are no lifecycle policies created for the selected Amazon ECR image repository.
2. If one or more rules are listed in the Lifecycle policy rules section, perform the following:
   • Select the lifecycle policy rule that you want to examine and choose Edit.
   • On the Edit lifecycle rule page, check the Image status and Match criteria configuration settings. If Image status setting is not set to Untagged and Match criteria is not set to Since image pushed, the selected lifecycle policy rule is not configured to remove untagged and old images from your image repository. Repeat this step for each lifecycle rule created for the selected Amazon ECR image repository.

07 Repeat steps no. 4 – 6 to check the associated lifecycle policies for other Amazon ECR repositories available within the current AWS region.

08 Change the AWS region from the navigation bar and repeat the audit process for other regions.

01 Run describe-repositories command (OSX/Linux/UNIX) to list the names of all Amazon ECR image repositories created in the selected AWS region:

aws ecr describe-repositories
	--region us-east-1
	--output table
	--query "repositories[*].repositoryName"

02 The command output should return a table with the requested identities (names):

-------------------------
| DescribeRepositories  |
+-----------------------+
|  cc-docker-web-repo   |
|  cc-production-repo   |
+-----------------------+

03 Run get-lifecycle-policy command (OSX/Linux/UNIX) using the name of the Amazon ECR image repository that you want to examine as identifier parameter, to describe the content of the lifecycle policy created for the selected repository:

aws ecr get-lifecycle-policy
	--region us-east-1
	--repository-name cc-docker-web-repo
	--query "lifecyclePolicyText"

04 The command output should return the content (i.e. lifecycle rule(s)) of the associated lifecycle policy or an error message:

• If get-lifecycle-policy command output returns the "LifecyclePolicyNotFoundException", there are no lifecycle policies created for the Amazon ECR image repositories available in the selected AWS region.
  An error occurred (LifecyclePolicyNotFoundException) when calling the GetLifecyclePolicy operation: Lifecycle policy does not exist for the repository with name 'cc-docker-web-repo' in the registry with id '123456789012'
  

• If get-lifecycle-policy command output returns one or more lifecycle rules, check each rule for the following combination of elements: "tagStatus" set to "untagged" and "countType" set to "sinceImagePushed". If none of the lifecycle rules defined for the selected repository have the specified combination of elements, as shown in the example below, the associated lifecycle policy is not configured to remove untagged and old images from the selected Amazon ECR image repository:
  {
      "rules": [
          {
              "rulePriority": 1,
              "description": "Keep only one untagged image, expire all others",
              "selection": {
                  "tagStatus": "untagged",
                  "countType": "imageCountMoreThan",
                  "countNumber": 1
              },
              "action": {
                  "type": "expire"
              }
          }
      ]
  }
  

05 Repeat step no. 3 and 4 to check the associated lifecycle policies for other Amazon ECR repositories available in the selected AWS region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the audit process for other regions.

01 Sign in to AWS Management Console.

02 Navigate to Amazon ECR console at https://console.aws.amazon.com/ecr.

03 In the navigation panel, under Amazon ECR, select Repositories to access your ECR image repositories.

04 Click on name of the image repository that you want to reconfigure, and choose Lifecycle Policy under Repositories.

05 On the Lifecycle Policy page, click on the Create rule button from the console top menu to initiate the setup process.

06 On the Create lifecycle rule setup page, perform the following:

1. For Rule priority, specify a unique rule priority. Values do not need to be sequential across rules in a policy.
2. Provide a short description for your lifecycle policy in the Rule description box.
3. For Image status choose Untagged to target untagged container images.
4. For Match criteria choose Since image pushed to select the count type to apply to your images. In the Days box, provide the number of days (for example, 14 days) after which your container images expire and will be deleted.
5. Ensure that Rule action is set to Expire.
6. Choose Save to create your new Amazon ECR lifecycle policy rule. After creating a lifecycle policy rule, the affected images are expired within 24 hours.

07 Repeat step no. 4 – 6 to create and configure lifecycle policies for other Amazon ECR image repositories available within the current AWS cloud region.

08 Change the AWS region from the navigation bar to repeat the remediation/resolution process for the other regions.

01 Define the lifecycle rule that will be added to the lifecycle policy associated with your Amazon ECR repository. The following example creates a lifecycle policy rule that removes untagged container images that are older than 14 days. Save the new lifecycle rule content to a JSON file named cc-lifecycle-policy-rule.json:

{
    "rules": [
        {
            "rulePriority": 1,
            "description": "Expire images older than 14 days.",
            "selection": {
                "tagStatus": "untagged",
                "countType": "sinceImagePushed",
                "countUnit": "days",
                "countNumber": 14
            },
            "action": {
                "type": "expire"
            }
        }
    ]
}

02 Run put-lifecycle-policy command (OSX/Linux/UNIX) using the name of the Amazon ECR image repository that you want to reconfigure as identifier parameter, to attach the lifecycle rule defined at the previous step (i.e. cc-lifecycle-policy-rule.json) to the lifecycle policy associated with the selected repository:

aws ecr put-lifecycle-policy
	--region us-east-1
	--repository-name cc-docker-web-repo
	--lifecycle-policy-text file://cc-lifecycle-policy-rule.json

03 The output should return the put-lifecycle-policy command request metadata (including the new lifecycle rule):

{
    "lifecyclePolicyText": "{
        {
            "rules": [
                {
                    "rulePriority": 1,
                    "description": "Expire images older than 14 days.",
                    "selection": {
                        "tagStatus": "untagged",
                        "countType": "sinceImagePushed",
                        "countUnit": "days",
                        "countNumber": 14
                    },
                    "action": {
                        "type": "expire"
                    }
                }
            ]
        }
    }",
    "repositoryName": "cc-docker-web-repo",
    "registryId": "123456789012"
}

04 Repeat step no. 1 – 3 to create and configure lifecycle policies for other Amazon ECR image repositories available in the selected AWS region.

05 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 4 to perform the entire remediation/resolution process for other regions.