An ECS service that OCRs scanned municipal deeds should always run a known image from Amazon ECR in production. Which practice best meets that requirement?

Container images in Amazon ECR are deployment artifacts. An ECS service that OCRs scanned municipal deeds in production should deploy an immutable image digest or unique version tag from ECR and never rely on a floating latest tag. Immutable references make civic document pipelines reproducible and rollbacks precise: operators know exactly which OCR engine bits processed a deed batch, which matters when courts and clerks dispute a misread page. Pinning the artifact is part of preparing a trustworthy deployable unit for Domain 3.

Always pulling latest fails because production becomes nondeterministic whenever anything is pushed to that tag, including accidental or unreviewed builds. Building images on each ECS host at startup so tags are unnecessary fails conceptually—host-local builds are not reviewed artifacts promoted from ECR. Storing only untagged images and letting the scheduler pick any digest fails because selection is uncontrolled relative to a tested release candidate.

Exam caveat: unique tags should be immutable in practice (do not retag the same name to a new digest); digests are the strongest pin when available in the task definition. Operational check: inspect the ECS task definition for a digest or unique release tag, confirm deploy pipelines record that identifier in change tickets, and verify rollback redeploys the prior digest without pulling latest.