app-staging-synthesizer: ecr repo not immutable

[tenjaa]

Describe the bug

AWS recommends ECR repos to have tag immutability configured.
The ECR repos created by this module to not do that.

Expected Behavior

The ECR repos created by this module should have tag immutability configured.

Current Behavior

The ECR repos created by this module do not have tag immutability configured.

Reproduction Steps

Deploy a stack with a docker image and have a look at the created repo.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.90.0

Framework Version

No response

Node.js Version

18

OS

OSX

Language

Typescript

Language Version

No response

Other information

No response

[peterwoodworth]

Is this a recommendation or a requirement? Also, could you share the docs where AWS recommends this?

[tenjaa]

Totally forgot the link: https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html
It is [ECR.2]

It is marked as should so probably more a recommendation.
But is there any downside in enabling it, given how cdk works? For the normal bootstrap this is also enabled if I remember correctly.

[peterwoodworth]

Thanks, we don't necessarily conform to security hub recommendations I have relabeled this as a feature request.

I don't know of any downsides, and you're right this is enabled in our bootstrap template. But also, it's not enabled by default in our construct

Regardless, thanks for the PR. We can consider it and get back to you

[tenjaa]

I put it as a bug because I saw that in the past, the CDK team merged a PR explicitly to fix a Security Hub finding.

Would you be more open to a PR to make in configurable?