AWS AmazonECR medium security documentation change
Summary
Expanded documentation for image tag mutability settings with new exclusion options and clarification that individual tag mutability isn't supported
Security assessment
The change adds explicit guidance about preventing image tag overwrites through immutable settings, which helps prevent unauthorized image modifications. The exclusion options provide granular control over tag mutability policies.
Diff
diff --git a/AmazonECR/latest/userguide/repository-create.md b/AmazonECR/latest/userguide/repository-create.md index c64020835..b706a9d32 100644 --- a//AmazonECR/latest/userguide/repository-create.md +++ b//AmazonECR/latest/userguide/repository-create.md @@ -21 +21 @@ Create an Amazon ECR private repository, and then use the repository to store yo - 3. On the **Repositories** page, choose **Private repositories** , and then choose **Create repository**. + 3. Choose **Private repositories** , and then choose **Create repository**. @@ -29 +29,9 @@ The repository name may container a maximum of `256` characters. The name must s - 5. For **Tag immutability** , choose the tag mutability setting for the repository. Repositories configured with immutable tags prevent image tags from being overwritten. For more information, see [Preventing image tags from being overwritten in Amazon ECR](./image-tag-mutability.html). + 5. For **Image tag immutability** , choose one of the following tag mutability settings for the repository. + + * **Mutable** – Choose this option if you want image tags to be overwritten. Recommended for repositories using pull through cache actions to ensure Amazon ECR can update cached images. Additionally, to disable tag updates for a few mutable tags, enter tag names or use wildcards (*) to match multiple similar tags in the **Mutable tag exclusion** text box. + + * **Immutable** – Choose this option if you want to prevent image tags from being overwritten, and it applies to all tags and exclusions in the repository when pushing an image with existing tag. Amazon ECR returns an `ImageTagAlreadyExistsException` if you attempt to push an image with an existing tag. Additionally, to enable tag updates for a few immutable tags, enter tag names or use wildcards (*) to match multiple similar tags in the **Immutable tag exclusion** text box. + +###### Note + +Individual tag mutability settings aren't supported.