In ECR I created a lifecycle policy to keep images for 10 years but it deleted them instead

Question

I have a private ECR image repository called "python-bot".

I wanted to add a Lifecycle Policy that would:
* Keep images with the tags `latest`, `main`, `cache` and any tag starting with `20` for 10 years
* Delete untagged images after 7 days
* Delete everything else after 60 days

I created the following lifecycle policy, however the problem is after I ran it it deleted all the images with `latest`, `main`, `cache`  and any tag starting with `20`.

What did I do wrong?

```
{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Keep images matching \"latest\", \"main\", \"master\", \"cache\" or start with 20",
      "selection": {
        "tagStatus": "tagged",
        "tagPatternList": [
          "latest",
          "main",
          "master",
          "cache",
          "20*"
        ],
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 3650
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Remove untagged images after 7 days",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 7
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 3,
      "description": "Remove anything else older than 60 days",
      "selection": {
        "tagStatus": "any",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 60
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}
```

Before:
![python-bot repo before the lifecycle policy](/media/postImages/original/IMpZMDlZthTFi7FMP8oOuB1g)

After:
![python-bot repo after the lifecycle policy ran](/media/postImages/original/IM698mLWcNTJy0mbwFdj8HwA)

Steve · Accepted Answer

The solution is to split the tags out into their own rules.

Previously having them all in one rule in a `tagPatternList` acted as an AND, so the image needed to be tagged with all the tags `latest`, `main`, `master` and `cache` for that particular rule to apply.

By splitting them out individually into their own rules acts like an OR, meaning it only needs to match one, so the most recent `main` tag is preserved, and because "An image that matches the tagging requirements of a rule cannot be expired by a rule with a lower priority" (according to https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html) that means the most recent `main` image will be preserved forever.

This way the most important tags last longer than 60 days, and everything else is deleted. The AWS AI answer keeps every single image for 10 years.

```
{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Keep most recent image with tag matching \"latest\"",
      "selection": {
        "tagStatus": "tagged",
        "tagPatternList": [
          "latest"
        ],
        "countType": "imageCountMoreThan",
        "countNumber": 1
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Keep most recent image with tag matching \"main\"",
      "selection": {
        "tagStatus": "tagged",
        "tagPatternList": [
          "main"
        ],
        "countType": "imageCountMoreThan",
        "countNumber": 1
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 3,
      "description": "Keep most recent image with tag matching \"master\"",
      "selection": {
        "tagStatus": "tagged",
        "tagPatternList": [
          "master"
        ],
        "countType": "imageCountMoreThan",
        "countNumber": 1
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 4,
      "description": "Keep most recent image with tag matching \"cache\"",
      "selection": {
        "tagStatus": "tagged",
        "tagPatternList": [
          "cache"
        ],
        "countType": "imageCountMoreThan",
        "countNumber": 1
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 5,
      "description": "Keep most recent 1000 images with tag starting with 20",
      "selection": {
        "tagStatus": "tagged",
        "tagPatternList": [
          "20*"
        ],
        "countType": "imageCountMoreThan",
        "countNumber": 1000
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 6,
      "description": "Remove untagged images after 7 days",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 7
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 7,
      "description": "Remove anything else older than 60 days",
      "selection": {
        "tagStatus": "any",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 60
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}
```

re:Post Agent · Answer

The issue with your lifecycle policy is in the first rule, which is intended to keep specific tagged images for 10 years. The problem lies in the "action" section of this rule.

In your policy, all rules, including the first one, have the action type set to "expire". This means that instead of keeping the images, the rule is actually set to expire (delete) them after 3650 days (10 years).

Lifecycle policies in Amazon ECR are designed to expire images, not to explicitly keep them. By default, images that don't match any expiration rules are kept indefinitely.

Your corrected lifecycle policy should look like this:

```json
{
    "rules": [
        {
            "rulePriority": 1,
            "description": "Remove untagged images after 10 years",
            "selection": {
                "tagStatus": "untagged",
                "countType": "sinceImagePushed",
                "countUnit": "days",
                "countNumber": 3650
            },
            "action": {
                "type": "expire"
            }
        }
    ]
}
```

This policy will:
1. Remove untagged images after 10 years

The images with the tags will be preserved indefinitely as they won't match any of these expiration rules. Unfortunately you cant specifcy a rule with a NOT TAG operator. This would be a nice feature but currently is not part of the rule set (Gary Mclean)

Remember to always use the lifecycle policy preview feature before applying a new policy to verify its effects on your images.  
**Sources**  
[Creating a lifecycle policy for a repository in Amazon ECR - Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/lp_creation.html)  
[Automate the cleanup of images by using lifecycle policies in Amazon ECR - Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html)  
[Lifecycle policy properties in Amazon ECR - Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/lifecycle_policy_parameters.html)  
[Creating a lifecycle policy preview in Amazon ECR - Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/lpp_creation.html)

In ECR I created a lifecycle policy to keep images for 10 years but it deleted them instead

Add your answer

Relevant content