A company uses AWS Organizations to manage a multi-account structure. The company has hundreds of AWS accounts and expects the number of accounts to increase. The company is building a new application that uses Docker images. The company will push the Docker images to Amazon Elastic Container Registry (Amazon ECR). Only accounts that are within the company’s organization should have access to the images. The company has a CI/CD process that runs frequently. The company wants to retain all the tagged images. However, the company wants to retain only the five most recent untagged images. Which solution will meet these requirements with the LEAST operational overhead?
Select one answer.
Marked answer: A
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
1
Option A A private repository in Amazon ECR restricts access to only authorized accounts within the company's organization. The permissions policy ensures that only required ECR operations are allowed, reducing operational overhead. The condition in the permissions policy allows ECR operations for accounts within the company's organization, further reducing overhead. Finally, adding a lifecycle rule to delete untagged images over the count of five simplifies image management and reduces storage costs.
1
How to associate the policy in ECR repository ? I think A is also wrong....
4
Answer A. Use ECR Lifecycle policy. Also using OrgId is more scalable with more accounts will be added than adding accounts individually. Less operational overhead.
