Automatically expire old or untagged images in AWS ECR using a lifecycle policy (JSON structure, apply, and preview)

Documented steps

1. Lifecycle policy JSON shape: { "rules": [ { "rulePriority": int, "description": "...", "selection": { "tagStatus": "tagged"|"untagged"|"any", "tagPatternList": [..] or "tagPrefixList": [..], "countType": "imageCountMoreThan"|"sinceImagePushed"|"sinceImagePulled"|"sinceImageTransitioned", "countUnit": "days", "countNumber": int }, "action": { "type": "expire"|"transition" } } ] }
2. Both tagPatternList (wildcard '*' matching, e.g. prod* matches prod, prod1, production-team1; max 4 wildcards per string) and tagPrefixList (exact tag prefixes) are supported — a single rule may use one or the other but not both, and either may only be used when tagStatus is 'tagged'.
3. Example — expire untagged images, keeping only the newest one: { "rules": [ { "rulePriority": 1, "description": "Keep only one untagged image, expire all others", "selection": { "tagStatus": "untagged", "countType": "imageCountMoreThan", "countNumber": 1 }, "action": { "type": "expire" } } ] }
4. Example — expire tagged images older than 14 days: selection { "tagStatus": "tagged", "tagPatternList": ["prod*"], "countType": "sinceImagePushed", "countUnit": "days", "countNumber": 14 } with action { "type": "expire" }. countUnit is only used with the since* countTypes; with imageCountMoreThan, images are sorted youngest-to-oldest and all beyond countNumber are expired.
5. Save the policy JSON to a file, then apply: aws ecr put-lifecycle-policy --repository-name repository-name --lifecycle-policy-text file://policy.json
6. Test before applying: aws ecr start-lifecycle-policy-preview --repository-name <name> [--lifecycle-policy-text <value>] — shows the results before associating the policy; if --lifecycle-policy-text is omitted, the repository's current policy is evaluated.
7. Evaluation timing: images become expired/archived within 24 hours after they meet the criteria — expiration is NOT immediate.
8. Rule evaluation: all rules are evaluated at the same time regardless of priority, then applied in priority order (lower rulePriority = higher priority); an image is expired/archived by exactly one rule or zero rules — a rule cannot claim an image already matched by a higher-priority rule.
9. Multi-arch note: if an image is referenced by a manifest list, it cannot be expired or archived without the manifest list being deleted or archived first.
10. Docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html ; https://docs.aws.amazon.com/AmazonECR/latest/userguide/lifecycle_policy_examples.html ; https://docs.aws.amazon.com/AmazonECR/latest/userguide/lp_creation.html ; https://docs.aws.amazon.com/cli/latest/reference/ecr/start-lifecycle-policy-preview.html