DET-R3: Tag immutability turned off¶
PutImageTagMutability to MUTABLE (ECR) or an UpdateRepository that disables immutable tags (Artifact Registry): released tags can now be overwritten.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | Image registry |
| Group | supply |
| Log source | CloudTrail · ECR / Cloud Audit Logs · Artifact Registry |
| Related check | REG-PIN-01: Deployment references immutable content |
Fires when¶
a watched repository's tag immutability was turned off
How it runs¶
untrust registry detect --policy <trust policy> reads registry audit events for the repositories the policy watches.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.