(aws-cdk): (CDK generates ECR repositories that don't have a lifecycle policy configured)

[meghannoelle]

Describe the bug

CDK provisioned ECR repositories cause the following finding in Security Hub:
ECR.3 ECR repositories should have at least one lifecycle policy configured
(https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#ecr%E2%80%943-remediation)

Expected Behavior

I expected CDK-provisioned ECR repositories to have at least one lifecycle policy configured.

Current Behavior

CDK-provisioned ECR repositories don't have a lifecycle policy configured and are breaching Security Hub's AWS foundational security best practices.

Reproduction Steps

Deploy an ECR repo and note the new security finding in Security Hub.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.35.0 (build 5c23578)

Framework Version

No response

Node.js Version

v14.18.1

OS

MacOS

Language

Typescript

Language Version

No response

Other information

No response

[peterwoodworth]

We don't necessarily support Security Hub guidelines by default. Here's some discussion around potential way we may be able to accomplish this in the future easily, but for now you can configure this with either lifecycleRules prop or addLifecycleRule method

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.