# Check ECR tag-rule priority before explaining an unexpired image

> Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.

- Canonical URL: https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:13:55+00:00
- Modified: 2026-10-20T18:34:29+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.

## Potentially affected

Review tag matching, rule precedence and manifest-list eligibility in ECR lifecycle policies.

## DSE recommendation

DSE recommends writing a rule matrix for representative release and development digests before diagnosing a cleanup gap.

## Article

Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.

## Source facts

ECR evaluates all lifecycle rules before applying their priorities; a lower number has higher priority. An image can be expired or archived by at most one rule. An image matching a higher-priority rule’s tagging requirements cannot be expired or archived by a lower-priority rule. An image referenced by a manifest list cannot expire or archive before that list is deleted or archived.

Source: [AWS Documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html).

## Applicability

Review tag matching, rule precedence and manifest-list eligibility in ECR lifecycle policies.

## DSE recommendation

DSE recommends writing a rule matrix for representative release and development digests before diagnosing a cleanup gap. Include each image’s tags, matching rules, priority numbers and the intended disposition. Check the higher-priority tagging match before widening a lower-priority cleanup pattern or shortening its count or age threshold. A different expiration result may be an intended consequence of precedence rather than a failed cleanup job. Keep approved rollback digests and multi-architecture manifest relationships visible to the release owner. Preserve the exact policy JSON and preview with an explanation for each deliberately retained image, so a later rule edit can be reviewed against the original selection decision.

## Verification

Proposed verification: in a controlled repository, preview two overlapping tag rules with different priorities and compare each selected digest with the written matrix. Include an image referenced by a manifest list and inspect its eligibility separately. Confirm the preview and expected precedence agree before authorizing any real cleanup; do not delete production release images merely to demonstrate the rule.

## Official reference

[AWS Documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS Documentation
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check ECR tag-rule priority before explaining an unexpired image,” DSE Security, https://update.dsesecurity.com/updates/check-ecr-tag-rule-priority-before-explaining-an-unexpired-image/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.