Project: KICS (Provisioning / Security & Compliance)
File: 33f41d31-86b1-46a4-81f7-9c9a671f59ac.md

title: ECR Image Tag Not Immutable hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 33f41d31-86b1-46a4-81f7-9c9a671f59ac Query name: ECR Image Tag Not Immutable Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: ECR should have an image tag be immutable. This prevents image tags from being overwritten.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="27 5" Resources: MyRepository3: Type: AWS::ECR::Repository Properties: ImageTagMutability: "MUTABLE" RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: Sid: AllowPushPull Effect: Allow Principal: AWS: "arn:aws:iam::123456789012:user/Bob" "arn:aws:iam::123456789012:user/Alice" Action: "ecr:GetDownloadUrlForLayer" "ecr:BatchGetImage" "ecr:BatchCheckLayerAvailability" "ecr:PutImage" "ecr:InitiateLayerUpload" "ecr:UploadLayerPart" "ecr:CompleteLayerUpload" MyRepository4: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: Sid: AllowPushPull Effect: Allow Principal: AWS: "arn:aws:iam::123456789012:user/Bob" "arn:aws:iam::123456789012:user/Alice" Action: "ecr:GetDownloadUrlForLayer" "ecr:BatchGetImage" "ecr:BatchCheckLayerAvailability" "ecr:PutImage" "ecr:InitiateLayerUpload" "ecr:UploadLayerPart" "ecr:CompleteLayerUpload" ``` ```json title="Positive test num. 2 - json file" hl_lines="36 6" { "Resources": { "MyRepository5": { "Type": "AWS::ECR::Repository", "Properties": { "ImageTagMutability": "MUTABLE", "RepositoryName": "test-repository", "RepositoryPolicyText": { "Version": "2008-10-17", "Statement": [ { "Sid": "AllowPushPull", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::123456789012:user/Bob", "arn:aws:iam::123456789012:user/Alice" ] }, "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:PutImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload" ] } ] } } }, "MyRepository6": { "Type": "AWS::ECR::Repository", "Properties": { "RepositoryName": "test-repository", "RepositoryPolicyText": { "Version": "2008-10-17", "Statement": [ { "Sid": "AllowPushPull", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::123456789012:user/Bob", "arn:aws:iam::123456789012:user/Alice" ] }, "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:PutImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload" ] } ] } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: MyRepository: Type: AWS::ECR::Repository Properties: ImageTagMutability: "IMMUTABLE" RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: Sid: AllowPushPull Effect: Allow Principal: AWS: "arn:aws:iam::123456789012:user/Bob" "arn:aws:iam::123456789012:user/Alice" Action: "ecr:GetDownloadUrlForLayer" "ecr:BatchGetImage" "ecr:BatchCheckLayerAvailability" "ecr:PutImage" "ecr:InitiateLayerUpload" "ecr:UploadLayerPart" "ecr:CompleteLayerUpload" ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyRepository2": { "Type": "AWS::ECR::Repository", "Properties": { "ImageTagMutability": "IMMUTABLE", "RepositoryName": "test-repository", "RepositoryPolicyText": { "Version": "2008-10-17", "Statement": [ { "Sid": "AllowPushPull", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::123456789012:user/Bob", "arn:aws:iam::123456789012:user/Alice" ] }, "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:PutImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload" ] } ] } } } } } ```