Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.
\nECR evaluates all lifecycle rules before applying their priorities; a lower number has higher priority. An image can be expired or archived by at most one rule. An image matching a higher-priority rule’s tagging requirements cannot be expired or archived by a lower-priority rule. An image referenced by a manifest list cannot expire or archive before that list is deleted or archived.
\nSource: AWS Documentation.
\nReview tag matching, rule precedence and manifest-list eligibility in ECR lifecycle policies.
\nDSE recommends writing a rule matrix for representative release and development digests before diagnosing a cleanup gap. Include each image’s tags, matching rules, priority numbers and the intended disposition. Check the higher-priority tagging match before widening a lower-priority cleanup pattern or shortening its count or age threshold. A different expiration result may be an intended consequence of precedence rather than a failed cleanup job. Keep approved rollback digests and multi-architecture manifest relationships visible to the release owner. Preserve the exact policy JSON and preview with an explanation for each deliberately retained image, so a later rule edit can be reviewed against the original selection decision.
\nProposed verification: in a controlled repository, preview two overlapping tag rules with different priorities and compare each selected digest with the written matrix. Include an image referenced by a manifest list and inspect its eligibility separately. Confirm the preview and expected precedence agree before authorizing any real cleanup; do not delete production release images merely to demonstrate the rule.
\nAWS Documentation. Reviewed October 20, 2026.
", "content_text": "Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.\nSource facts\nECR evaluates all lifecycle rules before applying their priorities; a lower number has higher priority. An image can be expired or archived by at most one rule. An image matching a higher-priority rule’s tagging requirements cannot be expired or archived by a lower-priority rule. An image referenced by a manifest list cannot expire or archive before that list is deleted or archived.\nSource: AWS Documentation.\nApplicability\nReview tag matching, rule precedence and manifest-list eligibility in ECR lifecycle policies.\nDSE recommendation\nDSE recommends writing a rule matrix for representative release and development digests before diagnosing a cleanup gap. Include each image’s tags, matching rules, priority numbers and the intended disposition. Check the higher-priority tagging match before widening a lower-priority cleanup pattern or shortening its count or age threshold. A different expiration result may be an intended consequence of precedence rather than a failed cleanup job. Keep approved rollback digests and multi-architecture manifest relationships visible to the release owner. Preserve the exact policy JSON and preview with an explanation for each deliberately retained image, so a later rule edit can be reviewed against the original selection decision.\nVerification\nProposed verification: in a controlled repository, preview two overlapping tag rules with different priorities and compare each selected digest with the written matrix. Include an image referenced by a manifest list and inspect its eligibility separately. Confirm the preview and expected precedence agree before authorizing any real cleanup; do not delete production release images merely to demonstrate the rule.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.\n\n## Source facts\n\nECR evaluates all lifecycle rules before applying their priorities; a lower number has higher priority. An image can be expired or archived by at most one rule. An image matching a higher-priority rule’s tagging requirements cannot be expired or archived by a lower-priority rule. An image referenced by a manifest list cannot expire or archive before that list is deleted or archived.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html).\n\n## Applicability\n\nReview tag matching, rule precedence and manifest-list eligibility in ECR lifecycle policies.\n\n## DSE recommendation\n\nDSE recommends writing a rule matrix for representative release and development digests before diagnosing a cleanup gap. Include each image’s tags, matching rules, priority numbers and the intended disposition. Check the higher-priority tagging match before widening a lower-priority cleanup pattern or shortening its count or age threshold. A different expiration result may be an intended consequence of precedence rather than a failed cleanup job. Keep approved rollback digests and multi-architecture manifest relationships visible to the release owner. Preserve the exact policy JSON and preview with an explanation for each deliberately retained image, so a later rule edit can be reviewed against the original selection decision.\n\n## Verification\n\nProposed verification: in a controlled repository, preview two overlapping tag rules with different priorities and compare each selected digest with the written matrix. Include an image referenced by a manifest list and inspect its eligibility separately. Confirm the preview and expected precedence agree before authorizing any real cleanup; do not delete production release images merely to demonstrate the rule.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/", "url": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Business Continuity", "item": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "ListItem", "position": 3, "name": "Check ECR tag-rule priority before explaining an unexpired image", "item": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/#article", "identifier": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/", "url": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/", "headline": "Check ECR tag-rule priority before explaining an unexpired image", "description": "Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.", "abstract": "Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.", "articleBody": "Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.\nSource facts\nECR evaluates all lifecycle rules before applying their priorities; a lower number has higher priority. An image can be expired or archived by at most one rule. An image matching a higher-priority rule’s tagging requirements cannot be expired or archived by a lower-priority rule. An image referenced by a manifest list cannot expire or archive before that list is deleted or archived.\nSource: AWS Documentation.\nApplicability\nReview tag matching, rule precedence and manifest-list eligibility in ECR lifecycle policies.\nDSE recommendation\nDSE recommends writing a rule matrix for representative release and development digests before diagnosing a cleanup gap. Include each image’s tags, matching rules, priority numbers and the intended disposition. Check the higher-priority tagging match before widening a lower-priority cleanup pattern or shortening its count or age threshold. A different expiration result may be an intended consequence of precedence rather than a failed cleanup job. Keep approved rollback digests and multi-architecture manifest relationships visible to the release owner. Preserve the exact policy JSON and preview with an explanation for each deliberately retained image, so a later rule edit can be reviewed against the original selection decision.\nVerification\nProposed verification: in a controlled repository, preview two overlapping tag rules with different priorities and compare each selected digest with the written matrix. Include an image referenced by a manifest list and inspect its eligibility separately. Confirm the preview and expected precedence agree before authorizing any real cleanup; do not delete production release images merely to demonstrate the rule.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:55+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check ECR tag-rule priority before explaining an unexpired image" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 265, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html" } } ] } }