Intermediate LevelCloud Computing (AWS/GCP/Azure)
How do Amazon ECR Image Scanning and Lifecycle Policies manage container images?
❓ Interview Prompt: Explain Amazon Elastic Container Registry (ECR), automated vulnerability scanning (Clair / Inspector), and Lifecycle cleanup rules.
Amazon Elastic Container Registry (ECR) is a fully-managed Docker container registry service.
Essential ECR Operations:
1
Image Vulnerability Scanning: ECR automatically scans pushed Docker container images for OS package vulnerabilities (CVEs) using Amazon Inspector, flagging vulnerabilities in CI/CD pipelines.
2
ECR Lifecycle Policies: Prevents ECR storage bloat by automatically purging old untagged container builds or retaining only the last $N$ image builds (e.g. "Keep last 10 tagged images, delete older images").
Code Implementation Example
hcl
# ECR Repository with Scan-on-Push and Lifecycle Policy
resource "aws_ecr_repository" "app" {
name = "my-web-app"
image_tag_mutability = "IMMUTABLE" # Prevents overwriting tags!
image_scanning_configuration {
scan_on_push = true # Automates vulnerability scanning!
}
}💡Terraform ECR repository configuration with immutable tags and scan-on-push.
🎯 Interview Key Takeaway
ECR scan-on-push flags container vulnerabilities automatically, while lifecycle policies purge stale container builds.
#ECR#Container Registry#Vulnerability Scanning#Docker#Intermediate
Back to all Cloud Computing (AWS/GCP/Azure) Questions→