A quarterly registry review should check six things: every repository has an owner, retention rules exist and behave, release tags are protected, access is least privilege, stale repositories are retired, and evidence is stored outside the registry. One hour with a short script is enough for most teams.
Why quarterly
Registries drift. Repositories appear on first push, owners leave, tokens outlive projects, and retention rules written for last year's release cadence stop fitting. Nothing breaks loudly, so a calendar reminder is the control.
The six checks
| Check | Question to answer | Evidence to record |
|---|---|---|
| Ownership | Does every repository name a team? | List of repositories with owner, and the unowned ones |
| Retention | Does each repository have a rule, and did it run? | Rule text, last run result or event log |
| Protection | Are release tags immutable or locked? | Setting per repository |
| Access | Who can push and delete, and are tokens in use? | Role and token list |
| Staleness | Which repositories have had no push or pull for a long time? | Candidates for retirement |
| Evidence | Are SBOMs and scan records kept outside the registry? | Location and retention period |
How to run each one
Ownership. Export the repository list and join it to your service inventory. Anything without a match gets an owner or a retirement ticket.
Retention. For each repository, read the rule and ask whether it still fits the release cadence. For ECR, lifecycle actions are logged as CloudTrail events, per the AWS documentation, so you can check the rule ran. See how to set an ECR lifecycle policy without deleting a live image.
Protection. Azure lets you lock images and repositories so they cannot be deleted or updated, and ECR offers tag immutability. Check release repositories use one of these. See lock, protect or immutable.
Access. List identities with push and delete rights. Remove those no longer needed. Rotate long lived tokens. See rotate a CI registry token without breaking builds.
Staleness. Look for repositories with no recent activity. Mark them deprecated first, announce, wait a period, then delete. See stale images in your registry.
Evidence. Spot check one recent release and confirm you can still produce its digest, SBOM and scan result.
Keep the output small
Write one page per quarter: what you found, what you changed, what you deferred. A short dated record also serves as audit evidence that the review happens.
Automate the boring parts
The listing steps are scriptable. A scheduled job that emits the six tables and flags exceptions turns the hour into a review of exceptions only. Safeguard's asset discovery and compliance evidence automation can help gather and keep these records. A free scan is at gold.safeguard.sh/scan.
Quick check
Is quarterly too often for a small team?
Twice a year can work if your release rate is low. Increase the frequency if repositories are created often.
Who should own the review?
The platform or DevOps owner of the registry, with each repository owner answering for their own items.
Sources
- Amazon ECR lifecycle policies
- Lock a container image in Azure Container Registry
- Amazon ECR image tag mutability
Last reviewed: 19 October 2026.
