Container Image Promotion across environments in ECR/ECS We have started doing some initial work on deploying containers on ECS Fargate service.
However we are not yet completely figured out how to manage our image promotion across different environments.
In our case, developers managed their own environment so they can deploy the docker image specifying just the tag of something they have built.
We only have UAT and PROD environments , As of now whatever we have in develop branch got baked in as image and pushed to ECR as develop tag and that gets deployed to UAT.
we release the code from develop to master as part of our release process.
During the release process ( from develop to master merge ) we create another container image this time on merge to master and that gets pushed to ECR as master tag which gets deployed to PROD.
I think this process is not ideal and it can be improved by a lot margin.

We shouldn't need to create image on each stage and should promote the same image tag in across environments ( i.e whatever we have in UAT will get QA/TESTED and released to PROD as artifact ), how are you managing this image promotion across environment ? what are other release process look like ?

We are currently tagging our image as branch tag i.e develop or master , How are you managing these tags creation ? Are you using GIT SHA ? or Sem ver ?


Any other improvements or general comments can be really helpful as well.
Although difficult to give a canonical answer, I think I understand your frustration. My opinion is  that you are focussing on promoting the wrong thing - the image.
I would start with the concept of &quot;Dev-Prod parity&quot; (or in your case, UAT/Prod parity). This concept says:

Keep development, staging, and production as similar as possible

The simplest way to do this is to use the same image in the two environments. The difference between them comes from the configuration and backing services. These are set at run time, not at build time - ie they are changed when you start the container not when you build it.
So, your process should look like:

Build the image, tag it with uat
UAT environment discovers new image, new image gets deployed
Run UAT against new deploy, they pass
tag that same image with latest
Prod discovers new image, gets deployed.

This process is extremely lightweight and you will have certainty in what is deployed.
TL;DR instead of promoting images and having to rebuild them, just shift the tag used in prod.