An ECS service that OCRs scanned municipal deeds should always run a known image from Amazon ECR in production. Which practice best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
latest is a moving target—fine for a laptop, terrible for deed OCR on go-live night. Pin production to a digest or a unique version tag in ECR so you know exactly which image is running. Floating tags and rebuild-on-host tricks erase that audit trail.
Full Explanation
Container images in Amazon ECR are deployment artifacts. Production ECS services should reference immutable identifiers such as a content digest or a unique release tag so rollouts are reproducible and rollbacks are precise. Using latest (or rebuilding on hosts) makes production nondeterministic and complicates incident response for civic document pipelines. Untagged selection is equally unsafe because the scheduler cannot guarantee a reviewed revision.