CostLensECR Repository Without Lifecycle Policy

ECR Repository Without Lifecycle Policy

CostLens flags private Amazon ECR repositories with no lifecycle policy — untagged layers and old images accumulate and bill as storage indefinitely.

Updated June 20261 min read

Without a lifecycle policy, every image pushed to an ECR repository is kept forever. Untagged layers from rebuilds and superseded image versions pile up and bill as storage. A default lifecycle policy reclaims that space automatically without affecting active deployments. This check has a one-click fix.

How it works

CostLens lists private repositories

Calls ecr:DescribeRepositories in each configured region.

Checks for a lifecycle policy

Calls ecr:GetLifecyclePolicy; a LifecyclePolicyNotFoundException (handled, not an error) means the repository has no policy.

Filters by size

Sums imageSizeInBytes from ecr:DescribeImages and skips repositories under 100 MB.

Estimates savings

Estimates the storage reclaimable with a policy (~30% of current size at ECR's ~$0.10/GB/month).

What to do

  1. Open the recommendation to see the image count and repository size.
  2. Apply the fix — CostLens calls ecr:PutLifecyclePolicy to add a default policy:
    • Keep the last 30 tagged images
    • Expire untagged images after 7 days
  3. The policy only affects future aging-out of images and can be rolled back within 24 hours from Fix History (it removes the policy CostLens added).

Safe defaults, reversible

The default policy retains recent tagged images used by deployments and only prunes untagged layers and old versions. You can adjust or remove it any time in the ECR console.

Severity levels

SeverityEstimated monthly savings
critical>$500
high$100–$500
medium$20–$100
low<$20

Required IAM permissions

Detection uses ReadOnlyAccess; the fix adds lifecycle write — included in the CostLens policies from AWS Accounts:

ecr:DescribeRepositories
ecr:GetLifecyclePolicy
ecr:DescribeImages
ecr:PutLifecyclePolicy
ecr:DeleteLifecyclePolicy

Limitations

  • Savings are estimated from current repository size and a typical reclaim ratio; actual results depend on how many untagged/old images exist.
  • Repositories under 100 MB are skipped as not worth acting on.
CostLens
Previous
Over-Provisioned Auto Scaling Group
Services
Next
Services Overview