ECR Image Build and Lifecycle

In this lab you'll operate Amazon ECR end-to-end like a DevOps engineer. You'll create an ECR repository with tag immutability and scan-on-push, build a small Dockerfile-based image and push two tagged versions, view the vulnerability scan results, apply a lifecycle policy that deletes untagged images older than 7 days while keeping the last 10 tagged images, and configure a same-account cross-region replication rule so the image is copied to a target region.

You will:

• Create a private ECR repository with `IMMUTABLE` tag mutability and scan-on-push enabled
• Authenticate Docker to ECR, build a tiny Alpine-based image, and push `:v1` and `:v2`
• Inspect ECR scan findings via the CLI
• Attach a JSON lifecycle policy with two rules (untagged > 7 days, keep last 10 tagged)
• Configure a cross-region replication rule (us-east-1 to us-west-2) and verify the replica

This lab uses the `ubuntu2024` image and the standard hardened TeKanAid AWS lab IAM policy with ECR access added. Docker is installed automatically by the setup script.