Q: How do you handle container image security and AWS ECR repository management?

Block vulnerabilities before images ever reach the container registry:

# Scan image for critical CVEs in CI pipeline
trivy image --exit-code 1 --severity CRITICAL,HIGH \
  --ignore-unfixed 123456789012.dkr.ecr.ap-south-1.amazonaws.com/api:v1.4.0

# Cryptographically sign the image using Cosign and AWS KMS
cosign sign --key awskms:///arn:aws:kms:ap-south-1:123456789012:key/cosign-key \
  123456789012.dkr.ecr.ap-south-1.amazonaws.com/api:v1.4.0

• Automated Trivy Scan: Scan the built container image in CI, setting --exit-code 1 --severity CRITICAL,HIGH to fail pipeline builds on unpatched vulnerabilities.
• Cryptographic Image Signing: Use Sigstore Cosign with AWS KMS or OIDC keyless signing to attach a digital signature to the image manifest in ECR.
• Admission Enforcement: Deploy Kyverno or OPA Gatekeeper in Kubernetes to reject any pod whose image lacks a verified Cosign signature.

Enforce repository hygiene, data protection, and storage cost controls in AWS ECR:

# Create ECR repository with Tag Immutability and KMS encryption
aws ecr create-repository --repository-name payment-api \
  --image-tag-mutability IMMUTABLE \
  --encryption-configuration encryptionType=KMS,kmsKey=arn:aws:kms:ap-south-1:123456789012:key/ecr-key \
  --image-scanning-configuration scanOnPush=true

# Apply lifecycle policy to expire untagged images after 3 days
aws ecr put-lifecycle-policy --repository-name payment-api \
  --lifecycle-policy-text '{
    "rules": [
      {"rulePriority": 1, "description": "Expire untagged images", "selection": {"tagStatus": "untagged", "countType": "sinceImagePushed", "countUnit": "days", "countNumber": 3}, "action": {"type": "expire"}},
      {"rulePriority": 2, "description": "Keep last 30 tagged", "selection": {"tagStatus": "any", "countType": "imageCountMoreThan", "countNumber": 30}, "action": {"type": "expire"}}
    ]
  }'

• Tag Immutability: Enable immutable tags on production repositories so existing release tags cannot be overwritten by subsequent builds.
• KMS Customer Managed Encryption: Encrypt repositories using AWS KMS customer managed keys (CMKs) to satisfy compliance mandates.
• Lifecycle Rules: Configure automated JSON lifecycle policies to expire untagged images after 3 days and retain only the last 30 tagged production images to eliminate storage bloat.
• Scan on Push: Enable continuous vulnerability assessment in ECR to monitor for newly disclosed zero-day vulnerabilities in deployed images.