(CDK-ECR): (ECR repositories should have at least one lifecycle policy configured)

[niraj-khandelwal]

Describe the bug

We have migrated our 140 accounts to AWS CDK.

As a company policy, we follow AWS Security best practices and as a part of that we have enabled Security Hub Standard - AWS Foundational Security Best Practices v1.0.0

Security Hub Standard does show a finding that -> ECR repositories should have at least one lifecycle policy configured.

ECR created by CDK is showing this finding across all accounts.

Requesting you to fix that.

Expected Behavior

ECR created by CDK should follow AWS defined Security standard and should have life cycle policy configured.

Current Behavior

ECR repositories should have does not have lifecycle policy configured.

Reproduction Steps

NA

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.69.0

Framework Version

No response

Node.js Version

NA

OS

Linux

Language

Python

Language Version

Python 3.9

Other information

No response

[pahud]

Thank you for your report. I am leaving this feature request open as p2 and welcome community upvotes to help us prioritize. At this moment, I believe you can simply use addLifeCycleRule() for all your ECR repos.

And, migrating 140 accounts to AWS CDK is awesome! Thanks for letting us know.

[rix0rrr]

Interesting you should bring this up. This was I believe just fixed here, released in v2.72.0.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.