search

data-dot-all / dataall

A modern data marketplace that makes collaboration among diverse users (like business, analysts and engineers) easier, increasing efficiency and agility in data projects on AWS.
https://data-dot-all.github.io/dataall/
Apache License 2.0
229 stars 82 forks source link

Remove old ECR images from tooling account #333

Open jeffshep opened 1 year ago

jeffshep commented 1 year ago

Is your idea related to a problem? Please describe. Amazon Inspector will scan and raise vulnerabilities against versions of ECR images that are not currently being used by data.all. ECR image maintenance should be a responsibility of the data.all service.

Describe the solution you'd like Automatically delete previous versions of ECR images when the tooling pipeline is run Maintaining at least the previous version is desire-able for any CloudFormation stack rollback requirements.

anmolsgandhi commented 4 months ago

@petrkalos @dlpzx is this still relevant or its fixed and we can close this?

petrkalos commented 4 months ago

Currently there is a lifecycle rule that keeps 200 images. I think the reqs here will be diverse, larger orgs might want to keep more for auditing purposes and smaller fewer as cost optimisation.

I think the best way to deal with it is to make the number of images to keep configurable via a context option. wdyt?

dlpzx commented 4 months ago

I agree, the requirements are very diverse. In the case of the original github issue purpose the idea was to reduce the number of stored images; but given that there is already a lifecycle rule in place I would fall to this default configuration. I don't think we should be investing time on this unless there is clear requirement to do so