feat(ecr): image tag mutability exclusion filters #35246

badmintoncryer · 2025-08-15T15:03:31Z

Issue # (if applicable)

Reason for this change

AWS ECR now supports for image tag mutability exclusion filters but AWS CDK L2 construct does not support this feature yet.

Description of changes

add imageTagMutabilityExclusionFilters prop to RepositoryProps
update TagMutability enum
define ImageTagMutabilityExclusionFilter class
- While ImageTagMutabilityExclusionFilterType currently supports only WILDCARD, future additions are anticipated. Factory method-based instance creation has been implemented to ensure user convenience and future extensibility.
- https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ecr-repository-imagetagmutabilityexclusionfilter.html#aws-properties-ecr-repository-imagetagmutabilityexclusionfilter-properties

Describe any new or updated permissions being added

None

Description of how you validated changes

Add both unit and integ tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

badmintoncryer · 2025-08-16T06:33:39Z

packages/aws-cdk-lib/aws-ecr/lib/repository.ts

+    const hasExclusionFilters = !!exclusionFilters;
+
+    if (hasExclusionFilters && !requiresExclusion) {
+      if (!tagMutability) {


This condition causes deployment error.

Resource handler returned message: "Invalid parameter at 'imageTagMutabilityExclusionFilters' failed to satisfy constraint: 'ImageTagMutabilityExclusionFilters are not allowed when imageTagMutability is set as null' (Service: Ecr, Status Code: 400, Request ID: 1a63b3a2-f3e8-491c-af9c-c869b094867e) (SDK Attempt Count: 1)" (RequestToken: 87f7cbaa-ce48-590e-cbed-0d4ae8139b5a, HandlerErrorCode: GeneralServiceException)

badmintoncryer · 2025-08-16T06:34:35Z

packages/aws-cdk-lib/aws-ecr/lib/repository.ts

+          'imageTagMutability must be specified when imageTagMutabilityExclusionFilters is provided.',
+          this,
+        );
+      } else {


This condition causes deployment error.

Resource handler returned message: "Invalid parameter at 'imageTagMutabilityExclusionFilters' failed to satisfy constraint: 'ImageTagMutabilityExclusionFilters are not allowed when imageTagMutability is set as IMMUTABLE' (Service: Ecr, Status Code: 400, Request ID: 6044fe0c-4fbb-454a-934c-5c2e1a5c8d03) (SDK Attempt Count: 1)" (RequestToken: 11f4763e-09ed-e19f-272e-ec47a466170f, HandlerErrorCode: GeneralServiceException) Resource handler returned message: "Invalid parameter at 'imageTagMutabilityExclusionFilters' failed to satisfy constraint: 'ImageTagMutabilityExclusionFilters are not allowed when imageTagMutability is set as MUTABLE' (Service: Ecr, Status Code: 400, Request ID: 80475a75-c3d4-4a8c-be4a-796dd2de2278) (SDK Attempt Count: 1)" (RequestToken: bec51a5b-8198-0aab-7a47-2cf59e44b0b3, HandlerErrorCode: GeneralServiceException)

badmintoncryer · 2025-08-16T06:35:15Z

packages/aws-cdk-lib/aws-ecr/lib/repository.ts

+      }
+    }
+
+    if (requiresExclusion && !hasExclusionFilters) {


This condition causes deployment error.

Resource handler returned message: "Invalid parameter at 'imageTagMutabilityExclusionFilters' failed to satisfy constraint: 'ImageTagMutabilityExclusionFilters can't be null when imageTagMutability is set as IMMUTABLE_WITH_EXCLUSION' (Service: Ecr, Status Code: 400, Request ID: bbbeac86-14dc-4c4a-b67d-5e39b6bc804d) (SDK Attempt Count: 1)" (RequestToken: a45ab23e-8817-52f1-8f80-dc9468d8b2fd, HandlerErrorCode: GeneralServiceException)

badmintoncryer · 2025-08-16T06:37:05Z

packages/aws-cdk-lib/aws-ecr/lib/repository.ts

+      if (filterCount === 0) {
+        throw new ValidationError('At least one exclusion filter must be specified when imageTagMutabilityExclusionFilters is provided.', this);
+      }
+      if (filterCount > 5) {
+        throw new ValidationError(`Cannot specify more than 5 exclusion filters, got ${filterCount}.`, this);
+      }


Filter size must be between 1 and 5.

https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecr-repository.html#cfn-ecr-repository-imagetagmutabilityexclusionfilters

go-to-k

Thanks for your changes. Looking forward to using the feature.

badmintoncryer · 2025-09-26T16:36:34Z

@go-to-k Thanks always!!

ozelalisen

Thank you, just have minor comments

ozelalisen · 2025-10-20T15:43:27Z

package.json

    "string-width": "^4.2.3"
-  }
+  },
+  "packageManager": "[email protected]+sha1.1959a18351b811cdeedbd484a8f86c3cc3bbaf72"


I assume this is not intended change

ozelalisen · 2025-10-21T10:55:33Z

packages/@aws-cdk-testing/framework-integ/test/aws-ecr/test/integ.tag-mutability-exclusion.ts

+    ecr.ImageTagMutabilityExclusionFilter.wildcard('dev-*'),
+    ecr.ImageTagMutabilityExclusionFilter.wildcard('test-*'),
+    ecr.ImageTagMutabilityExclusionFilter.wildcard('pr-*'),
+  ],


nit: would be better to use different exclusion filters as provided in README

Pull request has been modified.

badmintoncryer · 2025-10-21T15:58:18Z

@ozelalisen Thank you for your review! I've resolved all of your comments.

mergify · 2025-10-22T08:26:21Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-10-22T09:01:14Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-10-22T09:01:33Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

badmintoncryer added 6 commits August 15, 2025 21:34

feat: filter

e075626

add integ test

0710449

add validation

b872f34

add validation

8df18cf

refactor

54e585d

update

f3b42f3

aws-cdk-automation requested a review from a team August 15, 2025 15:03

github-actions bot added p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Aug 15, 2025

badmintoncryer changed the title ~~feat: image tag mutability exclusion filters~~ feat(ecr): image tag mutability exclusion filters Aug 15, 2025

aws-cdk-automation previously requested changes Aug 15, 2025

View reviewed changes

readme

64be192

badmintoncryer marked this pull request as ready for review August 16, 2025 06:27

badmintoncryer commented Aug 16, 2025

View reviewed changes

badmintoncryer added 2 commits August 16, 2025 15:42

refactor

bc124b4

Merge remote-tracking branch 'origin/main' into image-tag-mutability

3dc8eed

badmintoncryer force-pushed the image-tag-mutability branch from e43d952 to 3dc8eed Compare August 16, 2025 06:42

refactor

711fb18

badmintoncryer mentioned this pull request Aug 19, 2025

‘needs-xxx-review’ label is not attached to the pull request that has passed all CI processes #35268

Closed

1 task

badmintoncryer added 4 commits August 21, 2025 22:04

Merge branch 'main' into image-tag-mutability

e4976de

Merge branch 'main' into image-tag-mutability

915fc7a

Merge branch 'main' into image-tag-mutability

6b683f6

Merge branch 'main' into image-tag-mutability

e077f75

github-actions bot mentioned this pull request Sep 1, 2025

Monthly PR metrics report #35377

Closed

badmintoncryer added 2 commits September 2, 2025 00:06

Merge branch 'main' into image-tag-mutability

d130a19

Merge branch 'main' into image-tag-mutability

d39654d

ozelalisen mentioned this pull request Sep 3, 2025

chore(ecr): add new enum values for ecr #35384

Closed

Merge branch 'main' into image-tag-mutability

d97ddfc

Merge branch 'main' into image-tag-mutability

c2bd402

go-to-k approved these changes Sep 26, 2025

View reviewed changes

badmintoncryer changed the title ~~feat(ecr): image tag mutability exclusion filters~~ feat(ecr): support for image tag mutability exclusion filters Sep 26, 2025

github-actions bot added the effort/medium Medium work item – several days of effort label Sep 26, 2025

badmintoncryer changed the title ~~feat(ecr): support for image tag mutability exclusion filters~~ feat(ecr): image tag mutability exclusion filters Sep 26, 2025

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Sep 26, 2025

badmintoncryer added 4 commits September 28, 2025 09:47

Merge branch 'main' into image-tag-mutability

184a127

Merge branch 'main' into image-tag-mutability

d458333

Merge branch 'main' into image-tag-mutability

1860ac0

Merge branch 'main' into image-tag-mutability

8e4c5b0

ozelalisen self-assigned this Oct 20, 2025

ozelalisen previously requested changes Oct 21, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 21, 2025

badmintoncryer added 2 commits October 22, 2025 00:21

Merge remote-tracking branch 'origin/main' into image-tag-mutability

7c5c095

fix package.json

931ec43

update integ

e6cd696

ozelalisen approved these changes Oct 22, 2025

View reviewed changes

mergify bot added the queued label Oct 22, 2025

Merge branch 'main' into image-tag-mutability

9665687

mergify bot merged commit f6dd5cf into aws:main Oct 22, 2025
19 of 20 checks passed

mergify bot removed the queued label Oct 22, 2025

github-actions bot locked as resolved and limited conversation to collaborators Oct 22, 2025

badmintoncryer deleted the image-tag-mutability branch October 23, 2025 00:04

feat(ecr): image tag mutability exclusion filters #35246

feat(ecr): image tag mutability exclusion filters #35246

Uh oh!

Conversation

badmintoncryer commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Aug 16, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Aug 16, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Aug 16, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Aug 16, 2025

Choose a reason for hiding this comment

Uh oh!

go-to-k left a comment

Choose a reason for hiding this comment

Uh oh!

badmintoncryer commented Sep 26, 2025

Uh oh!

ozelalisen left a comment

Choose a reason for hiding this comment

Uh oh!

ozelalisen Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

ozelalisen Oct 21, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer commented Oct 21, 2025

Uh oh!

mergify bot commented Oct 22, 2025

Uh oh!

mergify bot commented Oct 22, 2025

Uh oh!

Uh oh!

github-actions bot commented Oct 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

badmintoncryer commented Aug 15, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading