A media company stores 800 container image versions in ECR across dev and prod, facing rising storage costs, stale vulnerable tags, and no visibility into base-image CVEs. Teams overwrite mutable tags and never clean up. Which container image management using security scans and lifecycle policies should the architect enforce?

The correct design combines three controls for the scenario’s three pressures: 800 versions drive up storage costs, mutable overwrites hide provenance, and missing base-image CVE visibility leaves teams without needed findings. Enhanced scanning through Inspector provides OS and language-package findings with continuous monitoring, while scan on push catches vulnerable images early. Immutable tags prevent silent overwrites and require new tags for traceability; lifecycle policies automatically expire untagged and stale tagged images, controlling cost and reducing vulnerable surface. Enhanced scanning and lifecycle cleanup with mutable tags may support flexible CI redeploys, but it preserves overwrite risk and undermines provenance and rollback reliability. Immutable tags and enhanced scanning with retention of all versioned images support provenance, visibility, and audit history, but fail the cost and hygiene goals: storage continues growing, and old vulnerable tags remain available for accidental deployment. Immutable tags with basic scanning and lifecycle cleanup control cost and prevent overwrites, but basic scanning covers only OS CVEs and lacks the deeper language-package findings and continuous enhanced insight needed for base images. Exam caveat: distinguish basic from enhanced scanning, and remember that immutability prevents overwrites while lifecycle policies manage retention. Practical check: verify Inspector enhanced scanning at registry and repository level, confirm tag immutability, and simulate lifecycle rules with dry-run counts before enforcing expiration in production.