A company with hundreds of AWS accounts in an AWS Organization will push Docker images to Amazon ECR. Only accounts within the Organization should access the images. The company’s CI/CD pipeline runs frequently; the company wants to retain all tagged images but keep only the five most recent untagged images. Which approach meets these requirements with the LEAST operational overhead?

The correct approach uses a private Amazon ECR repository with a repository policy that leverages aws:PrincipalOrgID to restrict access to only accounts within the AWS Organization. This is a secure and scalable method for managing access across hundreds of accounts without enumerating each one. ECR lifecycle rules natively support deleting untagged images beyond a specified count, directly meeting the retention requirement with minimal operational overhead. Incorrect options: Creating a public ECR repository is insecure as it makes images publicly accessible, violating the requirement for organization-only access. Enumerating all account IDs in a repository policy is operationally burdensome and not scalable for hundreds of accounts. Using a Lambda function for image deletion is more complex and costly than native ECR lifecycle rules. A public ECR repository is insecure. While VPC endpoints enhance connectivity, they don't address the fundamental security flaw of a public repository. Using a Lambda for deletion is less efficient than ECR lifecycle rules.