Write the rules, run the lifecycle policy preview to see exactly which images would expire, check that nothing a running service uses is on the list, then apply. Amazon ECR expires matching images within 24 hours after they meet the criteria, and each action is logged to CloudTrail.
What AWS documents
An ECR lifecycle policy holds one or more rules that decide which images in a private repository should expire. AWS advises using the preview to confirm which images a policy will expire before applying it. After you apply a policy, images should be expected to expire within 24 hours once they meet the criteria. Actions taken by a policy are captured as events in AWS CloudTrail.
Rules can match on tag status and on tag patterns. With a tag pattern list, wildcard filters apply, so a filter of prod* matches names that begin with prod, and prod matches names containing prod.
A safe rollout
- Inventory first. List which digests your clusters and functions reference today. Retention that deletes a running image causes the next restart to fail.
- Write narrow rules. Start with untagged images older than a set age, which are usually the safest group.
- Protect release tags. Use patterns to keep tags you rely on, such as version tags, and make sure the pattern really matches your naming. Review the tagging scheme in how to tag release images.
- Run the preview and read the full list. Compare it against step 1.
- Apply to a non critical repository first.
- Watch CloudTrail for the lifecycle events after 24 hours and confirm only expected images went.
- Document the retention period and the reason, so auditors and new engineers can see it.
Retention is a security and a compliance choice
Keeping everything forever grows the attack surface of old, unpatched images. Deleting too soon removes evidence you may need after an incident or for an audit. Pick periods by purpose: short for untagged build leftovers, longer for released versions. See stale images in your registry and what to archive for each release.
Do not forget what points at an image
Signatures and SBOMs attached to an image are separate objects. Check how your registry treats them when an image expires, and test it on a throwaway repository rather than assuming.
Safeguard's container image scanning can show which images in a registry carry open findings, which helps decide what to expire and what to patch.
Try it yourself
Click through it at your own pace, or open it full screen. Look for images with many findings that nobody should still be running.
Quick check
How fast does expiry happen?
AWS says to expect images to expire within 24 hours after they meet the policy criteria.
How do I test a policy first?
Use the lifecycle policy preview, which shows which images the policy would expire before you apply it.
Sources
Last reviewed: 19 October 2026.
