Check ECR tag-rule priority before explaining an unexpired image

Tag matching and expiration selection are separate stages in ECR lifecycle evaluation.

Source facts

ECR evaluates all lifecycle rules before applying their priorities; a lower number has higher priority. An image can be expired or archived by at most one rule. An image matching a higher-priority rule’s tagging requirements cannot be expired or archived by a lower-priority rule. An image referenced by a manifest list cannot expire or archive before that list is deleted or archived.

Source: AWS Documentation.

Applicability

Review tag matching, rule precedence and manifest-list eligibility in ECR lifecycle policies.

DSE recommendation

DSE recommends writing a rule matrix for representative release and development digests before diagnosing a cleanup gap. Include each image’s tags, matching rules, priority numbers and the intended disposition. Check the higher-priority tagging match before widening a lower-priority cleanup pattern or shortening its count or age threshold. A different expiration result may be an intended consequence of precedence rather than a failed cleanup job. Keep approved rollback digests and multi-architecture manifest relationships visible to the release owner. Preserve the exact policy JSON and preview with an explanation for each deliberately retained image, so a later rule edit can be reviewed against the original selection decision.

Verification

Proposed verification: in a controlled repository, preview two overlapping tag rules with different priorities and compare each selected digest with the written matrix. Include an image referenced by a manifest list and inspect its eligibility separately. Confirm the preview and expected precedence agree before authorizing any real cleanup; do not delete production release images merely to demonstrate the rule.

Official reference

AWS Documentation. Reviewed October 20, 2026.