Amazon ECR container security.

In Simple Words: Amazon Elastic Container Registry supports:

1. Tag Immutability: Prevents existing image tags (like latest or v1.0) from being overwritten.
2. Vulnerability Scanning: Automated scanning with AWS Inspector on push to find CVE vulnerabilities in container packages.

resource "aws_ecr_repository" "repo" {
  name                 = "production-api"
  image_tag_mutability = "IMMUTABLE" # Prevents tag overwriting!

  image_scanning_configuration {
    scan_on_push = true
  }
}