AWS AmazonECR documentation change
Summary
Added support for storage class parameters, expanded tag pattern handling, introduced 'sinceImageTransitioned' count type, and added 'transition' action type for archive storage
Security assessment
The changes introduce new lifecycle policy features (storage class transitions, tag pattern matching) and expand existing parameters, but there is no evidence of addressing security vulnerabilities or weaknesses. The 'transition' action helps manage storage classes for cost optimization rather than security hardening. No security advisories or vulnerability mitigations are mentioned.
Diff
diff --git a/AmazonECR/latest/userguide/lifecycle_policy_parameters.md b/AmazonECR/latest/userguide/lifecycle_policy_parameters.md index 8b20e44fa..31c2ba12a 100644 --- a//AmazonECR/latest/userguide/lifecycle_policy_parameters.md +++ b//AmazonECR/latest/userguide/lifecycle_policy_parameters.md @@ -5 +5 @@ -Rule priorityDescriptionTag statusTag pattern listTag prefix listCount typeCount unitCount numberAction +Rule priorityDescriptionTag statusTag pattern listTag prefix listStorage classCount typeCount unitCount numberAction @@ -44 +44 @@ Required: yes -Determines whether the lifecycle policy rule that you are adding specifies a tag for an image. Acceptable options are `tagged`, `untagged`, or `any`. If you specify `any`, then all images have the rule evaluated against them. If you specify `tagged`, then you must also specify a `tagPrefixList` value. If you specify `untagged`, then you must omit `tagPrefixList`. +Determines whether the lifecycle policy rule that you are adding specifies a tag for an image. Acceptable options are `tagged`, `untagged`, or `any`. If you specify `any`, then all images have the rule evaluated against them. If you specify `tagged`, then you must also specify a `tagPrefixList` value or a `tagPatternList` value. If you specify `untagged`, then you must omit both `tagPrefixList` and `tagPatternList`. @@ -71,0 +72,11 @@ Only used if you specified `"tagStatus": "tagged"` and you aren't specifying a ` +## Storage class + +`storageClass` + + +Type: string + +Required: yes, if `countType` is `sinceImageTransitioned` + +The rule will only select images of this storage class. When using a `countType` of `imageCountMoreThan`, `sinceImagePushed`, or `sinceImagePulled`, the only supported value is `standard`. When using a count type of `sinceImageTransitioned`, this is required, and the only supported value is `archive`. If you omit this, the value of `standard` will be used. + @@ -83 +94 @@ Specify a count type to apply to the images. -If `countType` is set to `imageCountMoreThan`, you also specify `countNumber` to create a rule that sets a limit on the number of images that exist in your repository. If `countType` is set to `sinceImagePushed`, you also specify `countUnit` and `countNumber` to specify a time limit on the images that exist in your repository. +If `countType` is set to `imageCountMoreThan`, you also specify `countNumber` to create a rule that sets a limit on the number of images that exist in your repository. If `countType` is set to `sinceImagePushed`, `sinceImagePulled`, or `sinceImageTransitioned`, you also specify `countUnit` and `countNumber` to specify a time limit on the images that exist in your repository. @@ -92 +103 @@ Type: string -Required: yes, only if `countType` is set to `sinceImagePushed` +Required: yes, only if `countType` is set to `sinceImagePushed`, `sinceImagePulled`, or `sinceImageTransitioned` @@ -96 +107 @@ Specify a count unit of `days` to indicate that as the unit of time, in addition -This should only be specified when `countType` is `sinceImagePushed`; an error will occur if you specify a count unit when `countType` is any other value. +This should only be specified when `countType` is `sinceImagePushed`, `sinceImagePulled`, or `sinceImageTransitioned`; an error will occur if you specify a count unit when `countType` is any other value. @@ -109 +120 @@ Specify a count number. Acceptable values are positive integers (`0` is not an a -If the `countType` used is `imageCountMoreThan`, then the value is the maximum number of images that you want to retain in your repository. If the `countType` used is `sinceImagePushed`, then the value is the maximum age limit for your images. +If the `countType` used is `imageCountMoreThan`, then the value is the maximum number of images that you want to retain in your repository. If the `countType` used is `sinceImagePushed`, then the value is the maximum age limit for your images. If the `countType` used is `sinceImagePulled`, then the value is the maximum number of days since the image was last pulled. If the `countType` used is `sinceImageTransitioned`, then the value is the maximum number of days since the image was archived. @@ -120 +131,10 @@ Required: yes -Specify an action type. The supported value is `expire`. +Specify an action type. The supported values are `expire` (to delete images) and `transition` (to move images to archive storage). + +`targetStorageClass` + + +Type: string + +Required: yes, if `type` is `transition` + +The storage class you want the lifecycle policy to transition the image to. `archive` is the only supported value. @@ -130 +150 @@ Examples of lifecycle policies -Security +Pull-time update exclusions