DET-R1: Watched tag moved to new content¶
A tag the registry policy deploys from was pushed again with a different digest, or now points away from the released digest: what deploys under that tag changed.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Image registry |
| Group | supply |
| Log source | CloudTrail · ECR |
| Related check | REG-PIN-01: Deployment references immutable content |
Fires when¶
a watched tag now resolves to a different digest (tag moved)
How it runs¶
untrust registry detect --policy <trust policy> reads registry audit events for the repositories the policy watches.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.