ECR repository should have image tag immutability enabled

What it checks

ECR repository: image tags are mutable.

Where it applies

Terraform: aws_ecr_repository

CloudFormation: AWS::ECR::Repository

How to fix it

1. Set image_tag_mutability = "IMMUTABLE". Update CI/CD to push unique version tags (e.g., git SHA) instead of overwriting 'latest'.

Frameworks

• AWS FSBP ECR.2
• SOC 2 CC7.1
• NIST 800-53 rev5 CM-3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules