From eaa8207cdfe4bfff40d4e114d535a613a3a6688a Mon Sep 17 00:00:00 2001 From: Leo Kacenjar Date: Tue, 7 Apr 2026 10:07:04 -0600 Subject: [PATCH] #1337 Prevent live lambda images from expiring. --- terraform/modules/deployment/main.tf | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/terraform/modules/deployment/main.tf b/terraform/modules/deployment/main.tf index edbd661d..2893c991 100644 --- a/terraform/modules/deployment/main.tf +++ b/terraform/modules/deployment/main.tf @@ -17,11 +17,27 @@ data "aws_iam_policy_document" "lambda_ecr" { } } -# ECR 30 day expiration policy. +# ECR expiration policy. Protects "latest"-tagged images; expires everything else after 30 days. data "aws_ecr_lifecycle_policy_document" "thirty_day_expiration_policy" { rule { priority = 1 - description = "Remove all images older than 30 days old that are not associated with an active service." + description = "Protect latest-tagged images." + + selection { + tag_status = "tagged" + tag_pattern_list = ["latest"] + count_type = "imageCountMoreThan" + count_number = 9999 + } + + action { + type = "expire" + } + } + + rule { + priority = 2 + description = "Remove all other images older than 30 days." selection { tag_status = "any"