ECR repository ignores immutable tags

[jcieniek-trek10]

Creating repository with imageTagMutability='IMMUTABLE' has no effect, i.e. you can call put_image with existing tag and it points to the new image afterwards. In AWS, if repository has immutable tags enabled, such action ends with "ImageAlreadyExistsException"

Regards,
Jan

[jcieniek-trek10]

That issue is actually more complicated than I thought - if you use one tag per image, everything works as expected. But if you use more, the result depends on sequence of tags.
So that scenario works as expected:

• put image with tag A
• put image with tag B
• put image with tag B - fails as expected

But that one does not:

• put image with tag A
• put image with tag B
• put image with tag A - works, but it should not

I'll prepare Python script to demonstrate.

[jcieniek-trek10]

The issue is described by test_... functions in ecr_tag_immutability_test_moto.py. If you need to check how ECR in AWS behaves, run ecr_tag_immutability_test_aws.py - it contains exactly the same tests, but assumes usage of existing AWS ECR and image to simplify setup (you need to provide these in constants

moto_tag_mutability_issue.zip