Build a Docker image in CI, push it to Amazon ECR with an immutable tag, enable scan-on-push, and expire untagged images via lifecycle policy

Documented steps

1. Create the repository with tag immutability and scan-on-push at creation: aws ecr create-repository --repository-name my-app --image-tag-mutability IMMUTABLE --image-scanning-configuration scanOnPush=true --region us-east-1
2. Authenticate Docker in the CI job: aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin <account-id>.dkr.ecr.us-east-1.amazonaws.com — the token is valid 12 hours, so re-run per job.
3. Build the image: docker build -t my-app:$GIT_SHA .
4. Tag with the full registry URI, not just a local name: docker tag my-app:$GIT_SHA <account-id>.dkr.ecr.us-east-1.amazonaws.com/my-app:$GIT_SHA
5. Push: docker push <account-id>.dkr.ecr.us-east-1.amazonaws.com/my-app:$GIT_SHA — use a unique tag (git SHA) per build since IMMUTABLE repos reject re-pushing an existing tag with ImageTagAlreadyExistsException.
6. If mutability wasn't set at creation: aws ecr put-image-tag-mutability --repository-name my-app --image-tag-mutability IMMUTABLE
7. Confirm the push-triggered scan and pull findings: aws ecr describe-image-scan-findings --repository-name my-app --image-id imageTag=$GIT_SHA
8. Write a lifecycle policy JSON expiring untagged images: {"rules":[{"rulePriority":1,"description":"Expire untagged images older than 14 days","selection":{"tagStatus":"untagged","countType":"sinceImagePushed","countUnit":"days","countNumber":14},"action":{"type":"expire"}}]}
9. Preview before applying: aws ecr start-lifecycle-policy-preview --repository-name my-app --lifecycle-policy-text file://lifecycle-policy.json then aws ecr get-lifecycle-policy-preview --repository-name my-app
10. Apply it: aws ecr put-lifecycle-policy --repository-name my-app --lifecycle-policy-text file://lifecycle-policy.json
11. Grant the CI role ecr:GetAuthorizationToken (resource *) plus ecr:BatchCheckLayerAvailability, ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload, ecr:PutImage on the repository ARN.
12. Official docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/getting-started-cli.html | https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html | https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html | https://docs.aws.amazon.com/AmazonECR/latest/userguide/lifecycle_policy_examples.html