能否为ECR中所有仓库配置统一的生命周期策略？

Great question—you’re exactly right that AWS ECR doesn’t offer a direct, built-in way to apply a single lifecycle policy across all existing and new repositories out of the box. Let’s walk through practical solutions to handle this, both for your current repos and automating the process for future ones:

Batch apply to existing repositories via AWS CLI #

Your initial thought to use the CLI is solid—it’s the quickest way to standardize policies across all existing repos. Here’s a step-by-step breakdown:

1. First, save your desired lifecycle policy to a local JSON file, say ecr-universal-policy.json. Example policy (adjust the rules to fit your needs):

   {
     "rules": [
       {
         "rulePriority": 1,
         "description": "Expire images older than 30 days",
         "selection": {
           "tagStatus": "any",
           "countType": "sinceImagePushed",
           "countNumber": 30
         },
         "action": {
           "type": "expire"
         }
       }
     ]
   }
   

2. Run this bash command to fetch all your ECR repo names and apply the policy to each one in bulk:

   aws ecr describe-repositories --query 'repositories[*].repositoryName' --output text | tr '\t' '\n' | while read repo; do
     aws ecr put-lifecycle-policy --repository-name "$repo" --lifecycle-policy-text file://ecr-universal-policy.json
     echo "Applied policy to repository: $repo"
   done
   

   This will loop through every repo in your account and push your standardized policy to it.

Automate policy application for new repositories #

To eliminate the manual step of running the CLI every time you create a new repo, use one of these automation approaches:

• Infrastructure as Code (IaC): Define all your ECR repos using CloudFormation or Terraform, and embed the lifecycle policy directly into the repo resource definition. This ensures every new repo created via IaC automatically gets the policy.
  Example Terraform snippet:

  resource "aws_ecr_repository" "standard_repo" {
    name                 = "my-new-service-repo"
    image_tag_mutability = "MUTABLE"
  
    lifecycle_policy {
      policy = jsonencode({
        rules = [
          {
            rulePriority = 1
            description  = "Expire images older than 30 days"
            selection = {
              tagStatus = "any"
              countType = "sinceImagePushed"
              countNumber = 30
            }
            action = {
              type = "expire"
            }
          }
        ]
      })
    }
  }
  

• Lambda + EventBridge: Set up an EventBridge rule that triggers a Lambda function whenever a new ECR repository is created. The Lambda function can use the AWS SDK (like boto3 for Python) to automatically apply your predefined policy to the new repo. The EventBridge event will pass the repo name directly to the function, so you don’t have to hardcode anything.

Quick reminders #

• If you update your universal policy later, you’ll need to re-run the batch CLI command (or update your IaC/Lambda logic) to propagate changes to all existing repos.
• Keep your policy JSON consistent across all automation tools to avoid conflicting rules.

内容的提问来源于stack exchange，提问作者Alex