security: deploy immutable container image references to ECS

[damienjburks]

Summary

The Herald currently uses a mutable ECR repository and configures the ECS task definition to run the :latest image tag.

That makes the production task definition weakly bound to a specific build artifact: the same tag can later point to different image content, making rollback, auditability, and security verification less reliable.

Refactor the image delivery flow so production deployments use an immutable image reference tied to the exact artifact that was built and validated.

Current State

Terraform currently configures:

resource "aws_ecr_repository" "the_herald" {
  image_tag_mutability = "MUTABLE"
}

and the ECS task definition references:

image = "${aws_ecr_repository.the_herald.repository_url}:latest"

Objective

Ensure the image that is built, security-validated, and approved is the same image that ECS deploys.

Requirements

• Stop using :latest as the production deployment reference.
• Prefer an immutable image digest or a unique build/commit tag that cannot be overwritten.
• Review whether ECR should use IMMUTABLE tag mutability for release tags.
• Ensure the deployment process captures the built image reference and passes that exact reference into the ECS task definition/deployment.
• Preserve an understandable rollback path to a prior known-good image.
• Avoid rebuilding a different image during deployment after security validation has completed.
• Update Terraform variables/inputs and deployment documentation as needed.
• Preserve ECR lifecycle management without deleting images still required for active deployments or supported rollback.

Desired Artifact Flow

Build image
    ↓
Tag uniquely / resolve digest
    ↓
Scan and validate exact image
    ↓
Deploy exact same reference to ECS

Security Rationale

A mutable tag such as latest is a pointer, not an immutable artifact identity. Production should be able to answer exactly which image digest is running and prove that it matches the artifact that passed the delivery controls.

Acceptance Criteria

• ECS no longer deploys the-herald:latest as its production image reference.
• Each production deployment references an immutable image identity.
• The deployed image can be traced back to a specific source commit/build.
• The same image that is scanned/validated is the image deployed.
• Release image tags cannot be unintentionally overwritten, or digest pinning makes tag mutation irrelevant.
• A documented rollback procedure exists.
• Existing ECS deployment behavior remains functional.

Contributor Guidance

Level: Intermediate
Area: Software Supply Chain / ECS / ECR / CI/CD Security

This issue should demonstrate artifact integrity across a delivery pipeline rather than simply replacing one tag string with another.