ECR images and container supply chain

Exam alignment: DOP-C02 Domain 1 task statements for pipelines, testing, artifacts, or deployment.

Learning objective

Use image digests, tag immutability, scanning, and lifecycle rules for safe releases.

Difficulty / Schwierigkeitsgrad	Intermediate
Study time / Lernzeit	120 minutes
Prerequisites / Voraussetzungen	Previous lessons in this volume

Professional scenario

Production deploys latest; rollback cannot identify the old image.

Core concepts

• ECR stores images and content digests.
• Tags are labels and may be mutable.
• Deployment by digest identifies exact bytes.
• Scanning must connect to an enforcement policy.

Architecture flow

1. Identify the release input and immutable identity.
2. Select the managed AWS control plane and least-privilege role.
3. Execute build, test, artifact, or deployment work.
4. Collect service events, logs, reports, and runtime metrics.
5. Stop, retry, or roll back according to explicit rules.

Decision matrix

Requirement	Preferred choice	Reason
Exact image identity	Digest	Immutable content
Protect release tags	Tag immutability	Prevents replacement
Storage cleanup	Lifecycle preview and policy	Avoid deleting rollback images

Failure modes and troubleshooting

• Task execution role cannot pull image.
• Build can login but cannot upload.
• Lifecycle removes active digest.

Security and operations

• Use short-lived service roles and least privilege.
• Encrypt artifacts and protect logs from secret exposure.
• Record changes and approvals for audit.

Hands-on lab

Goal / Ziel: Push a small image and record its digest.

Tasks

1. Create the smallest safe test architecture.
2. Implement or simulate the main workflow.
3. Introduce one controlled failure.
4. Diagnose it from service evidence.
5. Document cleanup and one improvement.

Validation

• The workflow uses an immutable version.
• A required failure blocks promotion.
• The diagnosis identifies the first failed transition.

Cost control / Kostenkontrolle: Keep resources short lived; read cleanup before starting.

Cleanup

1. Delete pipeline/build/deployment resources.
2. Delete temporary artifacts, images, logs, and roles.

Exam traps

• Production by latest.
• Scanning without a gate.

Key takeaways

• ECR stores images and content digests.
• Scanning must connect to an enforcement policy.
• Decisions must be justified by requirements and failure behavior.

Review questions

1. What is the immutable release identity?
2. Which evidence proves failure or success?
3. What is the safest recovery action?

Answers

1. A version, digest, or uniquely versioned artifact.
2. Service events, logs, reports, health checks, and runtime metrics.
3. Restore the known-good version using the configured rollback path.