aws-cdk-lib 2.195.0__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_ecr/__init__.py

@@ -128,12 +128,51 @@ By using these methods, you can grant specific operational permissions on the EC
 
 ### Image tag immutability
 
-You can set tag immutability on images in our repository using the `imageTagMutability` construct prop.
+You can set tag immutability on images in your repository using the `imageTagMutability` construct prop.
 
 ```python
 ecr.Repository(self, "Repo", image_tag_mutability=ecr.TagMutability.IMMUTABLE)
 ```
 
+#### Image tag mutability with exclusion filters
+
+ECR supports more granular control over image tag mutability by allowing you to specify exclusion filters. This enables you to make your repository immutable while allowing specific tag patterns to remain mutable (or vice versa).
+
+There are two new mutability options that work with exclusion filters:
+
+* `MUTABLE_WITH_EXCLUSION`: Tags are mutable by default, except those matching the exclusion filters
+* `IMMUTABLE_WITH_EXCLUSION`: Tags are immutable by default, except those matching the exclusion filters
+
+Use `ImageTagMutabilityExclusionFilter.wildcard()` to create filters with wildcard patterns:
+
+```python
+# Make all tags immutable except for those starting with 'dev-' or 'test-'
+ecr.Repository(self, "Repo",
+    image_tag_mutability=ecr.TagMutability.IMMUTABLE_WITH_EXCLUSION,
+    image_tag_mutability_exclusion_filters=[
+        ecr.ImageTagMutabilityExclusionFilter.wildcard("dev-*"),
+        ecr.ImageTagMutabilityExclusionFilter.wildcard("test-*")
+    ]
+)
+```
+
+```python
+# Make all tags mutable except for production releases
+ecr.Repository(self, "Repo",
+    image_tag_mutability=ecr.TagMutability.MUTABLE_WITH_EXCLUSION,
+    image_tag_mutability_exclusion_filters=[
+        ecr.ImageTagMutabilityExclusionFilter.wildcard("prod-*"),
+        ecr.ImageTagMutabilityExclusionFilter.wildcard("release-v*")
+    ]
+)
+```
+
+##### Exclusion filter pattern rules
+
+* Patterns can contain alphanumeric characters, dots (.), underscores (_), hyphens (-), and asterisks (*) as wildcards
+* Maximum pattern length is 128 characters
+* You can specify up to 5 exclusion filters per repository
+
 ### Encryption
 
 By default, Amazon ECR uses server-side encryption with Amazon S3-managed encryption keys which encrypts your data at rest using an AES-256 encryption algorithm. For more control over the encryption for your Amazon ECR repositories, you can use server-side encryption with KMS keys stored in AWS Key Management Service (AWS KMS). Read more about this feature in the [ECR Developer Guide](https://docs.aws.amazon.com/AmazonECR/latest/userguide/encryption-at-rest.html).
@@ -320,7 +359,23 @@ from ..aws_iam import (
     IGrantable as _IGrantable_71c4f5de,
     PolicyStatement as _PolicyStatement_0fe33853,
 )
-from ..aws_kms import IKey as _IKey_5f11635f
+from ..interfaces.aws_ecr import (
+    IPublicRepositoryRef as _IPublicRepositoryRef_fef651e6,
+    IPullThroughCacheRuleRef as _IPullThroughCacheRuleRef_6d4698a2,
+    IRegistryPolicyRef as _IRegistryPolicyRef_42ef4743,
+    IRegistryScanningConfigurationRef as _IRegistryScanningConfigurationRef_777252de,
+    IReplicationConfigurationRef as _IReplicationConfigurationRef_a2ce7034,
+    IRepositoryCreationTemplateRef as _IRepositoryCreationTemplateRef_b7cd8f39,
+    IRepositoryRef as _IRepositoryRef_f3b81117,
+    PublicRepositoryReference as _PublicRepositoryReference_b2001418,
+    PullThroughCacheRuleReference as _PullThroughCacheRuleReference_c998144d,
+    RegistryPolicyReference as _RegistryPolicyReference_2d2e9fdc,
+    RegistryScanningConfigurationReference as _RegistryScanningConfigurationReference_4b2666f2,
+    ReplicationConfigurationReference as _ReplicationConfigurationReference_d963555d,
+    RepositoryCreationTemplateReference as _RepositoryCreationTemplateReference_4a34e559,
+    RepositoryReference as _RepositoryReference_af4d81f0,
+)
+from ..interfaces.aws_kms import IKeyRef as _IKeyRef_d4fc6ef3
 
 
 class AuthorizationToken(
@@ -351,7 +406,7 @@ class AuthorizationToken(
         return typing.cast(None, jsii.sinvoke(cls, "grantRead", [grantee]))
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IPublicRepositoryRef_fef651e6, _ITaggable_36806126)
 class CfnPublicRepository(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -395,7 +450,8 @@ class CfnPublicRepository(
         repository_policy_text: typing.Any = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::ECR::PublicRepository``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param repository_catalog_data: The details about the repository that are publicly visible in the Amazon ECR Public Gallery. For more information, see `Amazon ECR Public repository catalog data <https://docs.aws.amazon.com/AmazonECR/latest/public/public-repository-catalog-data.html>`_ in the *Amazon ECR Public User Guide* .
@@ -416,6 +472,48 @@ class CfnPublicRepository(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromPublicRepositoryArn")
+    @builtins.classmethod
+    def from_public_repository_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IPublicRepositoryRef_fef651e6:
+        '''Creates a new IPublicRepositoryRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__df08363dd3d49b4b281729649cda34a42b796ed2c1c7a9e6c28145049dcd5bf9)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IPublicRepositoryRef_fef651e6, jsii.sinvoke(cls, "fromPublicRepositoryArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromRepositoryName")
+    @builtins.classmethod
+    def from_repository_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        repository_name: builtins.str,
+    ) -> _IPublicRepositoryRef_fef651e6:
+        '''Creates a new IPublicRepositoryRef from a repositoryName.
+
+        :param scope: -
+        :param id: -
+        :param repository_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a12c8d1af48bfd21b0af8b54f0dfaf211699928aac8fb0ffb2e0ff8ce482ac1a)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument repository_name", value=repository_name, expected_type=type_hints["repository_name"])
+        return typing.cast(_IPublicRepositoryRef_fef651e6, jsii.sinvoke(cls, "fromRepositoryName", [scope, id, repository_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -462,6 +560,12 @@ class CfnPublicRepository(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="publicRepositoryRef")
+    def public_repository_ref(self) -> _PublicRepositoryReference_b2001418:
+        '''A reference to a PublicRepository resource.'''
+        return typing.cast(_PublicRepositoryReference_b2001418, jsii.get(self, "publicRepositoryRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -769,7 +873,7 @@ class CfnPublicRepositoryProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IPullThroughCacheRuleRef_6d4698a2)
 class CfnPullThroughCacheRule(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -811,7 +915,8 @@ class CfnPullThroughCacheRule(
         upstream_registry_url: typing.Optional[builtins.str] = None,
         upstream_repository_prefix: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::ECR::PullThroughCacheRule``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param credential_arn: The ARN of the Secrets Manager secret associated with the pull through cache rule.
@@ -871,6 +976,12 @@ class CfnPullThroughCacheRule(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="pullThroughCacheRuleRef")
+    def pull_through_cache_rule_ref(self) -> _PullThroughCacheRuleReference_c998144d:
+        '''A reference to a PullThroughCacheRule resource.'''
+        return typing.cast(_PullThroughCacheRuleReference_c998144d, jsii.get(self, "pullThroughCacheRuleRef"))
+
     @builtins.property
     @jsii.member(jsii_name="credentialArn")
     def credential_arn(self) -> typing.Optional[builtins.str]:
@@ -1088,7 +1199,7 @@ class CfnPullThroughCacheRuleProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IRegistryPolicyRef_42ef4743)
 class CfnRegistryPolicy(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1122,7 +1233,8 @@ class CfnRegistryPolicy(
         *,
         policy_text: typing.Any,
     ) -> None:
-        '''
+        '''Create a new ``AWS::ECR::RegistryPolicy``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param policy_text: The JSON policy text for your registry.
@@ -1179,6 +1291,12 @@ class CfnRegistryPolicy(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="registryPolicyRef")
+    def registry_policy_ref(self) -> _RegistryPolicyReference_2d2e9fdc:
+        '''A reference to a RegistryPolicy resource.'''
+        return typing.cast(_RegistryPolicyReference_2d2e9fdc, jsii.get(self, "registryPolicyRef"))
+
     @builtins.property
     @jsii.member(jsii_name="policyText")
     def policy_text(self) -> typing.Any:
@@ -1248,7 +1366,7 @@ class CfnRegistryPolicyProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IRegistryScanningConfigurationRef_777252de)
 class CfnRegistryScanningConfiguration(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1286,7 +1404,8 @@ class CfnRegistryScanningConfiguration(
         rules: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRegistryScanningConfiguration.ScanningRuleProperty", typing.Dict[builtins.str, typing.Any]]]]],
         scan_type: builtins.str,
     ) -> None:
-        '''
+        '''Create a new ``AWS::ECR::RegistryScanningConfiguration``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param rules: The scanning rules associated with the registry.
@@ -1344,6 +1463,14 @@ class CfnRegistryScanningConfiguration(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="registryScanningConfigurationRef")
+    def registry_scanning_configuration_ref(
+        self,
+    ) -> _RegistryScanningConfigurationReference_4b2666f2:
+        '''A reference to a RegistryScanningConfiguration resource.'''
+        return typing.cast(_RegistryScanningConfigurationReference_4b2666f2, jsii.get(self, "registryScanningConfigurationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="rules")
     def rules(
@@ -1607,7 +1734,7 @@ class CfnRegistryScanningConfigurationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IReplicationConfigurationRef_a2ce7034)
 class CfnReplicationConfiguration(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1655,7 +1782,8 @@ class CfnReplicationConfiguration(
         *,
         replication_configuration: typing.Union[_IResolvable_da3f097b, typing.Union["CfnReplicationConfiguration.ReplicationConfigurationProperty", typing.Dict[builtins.str, typing.Any]]],
     ) -> None:
-        '''
+        '''Create a new ``AWS::ECR::ReplicationConfiguration``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param replication_configuration: The replication configuration for a registry.
@@ -1714,6 +1842,14 @@ class CfnReplicationConfiguration(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="replicationConfigurationRef")
+    def replication_configuration_ref(
+        self,
+    ) -> _ReplicationConfigurationReference_d963555d:
+        '''A reference to a ReplicationConfiguration resource.'''
+        return typing.cast(_ReplicationConfigurationReference_d963555d, jsii.get(self, "replicationConfigurationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="replicationConfiguration")
     def replication_configuration(
@@ -2102,7 +2238,7 @@ class CfnReplicationConfigurationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IRepositoryRef_f3b81117, _ITaggable_36806126)
 class CfnRepository(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2136,6 +2272,10 @@ class CfnRepository(
                 scan_on_push=False
             ),
             image_tag_mutability="imageTagMutability",
+            image_tag_mutability_exclusion_filters=[ecr.CfnRepository.ImageTagMutabilityExclusionFilterProperty(
+                image_tag_mutability_exclusion_filter_type="imageTagMutabilityExclusionFilterType",
+                image_tag_mutability_exclusion_filter_value="imageTagMutabilityExclusionFilterValue"
+            )],
             lifecycle_policy=ecr.CfnRepository.LifecyclePolicyProperty(
                 lifecycle_policy_text="lifecyclePolicyText",
                 registry_id="registryId"
@@ -2158,18 +2298,21 @@ class CfnRepository(
         encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRepository.EncryptionConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         image_scanning_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRepository.ImageScanningConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         image_tag_mutability: typing.Optional[builtins.str] = None,
+        image_tag_mutability_exclusion_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRepository.ImageTagMutabilityExclusionFilterProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         lifecycle_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRepository.LifecyclePolicyProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         repository_name: typing.Optional[builtins.str] = None,
         repository_policy_text: typing.Any = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::ECR::Repository``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param empty_on_delete: If true, deleting the repository force deletes the contents of the repository. If false, the repository must be empty before attempting to delete it.
         :param encryption_configuration: The encryption configuration for the repository. This determines how the contents of your repository are encrypted at rest.
-        :param image_scanning_configuration: The image scanning configuration for the repository. This determines whether images are scanned for known vulnerabilities after being pushed to the repository.
+        :param image_scanning_configuration: .. epigraph:: The ``imageScanningConfiguration`` parameter is being deprecated, in favor of specifying the image scanning configuration at the registry level. For more information, see ``PutRegistryScanningConfiguration`` . The image scanning configuration for the repository. This determines whether images are scanned for known vulnerabilities after being pushed to the repository.
         :param image_tag_mutability: The tag mutability setting for the repository. If this parameter is omitted, the default setting of ``MUTABLE`` will be used which will allow image tags to be overwritten. If ``IMMUTABLE`` is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
+        :param image_tag_mutability_exclusion_filters: A list of filters that specify which image tags are excluded from the repository's image tag mutability setting.
         :param lifecycle_policy: Creates or updates a lifecycle policy. For information about lifecycle policy syntax, see `Lifecycle policy template <https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html>`_ .
         :param repository_name: The name to use for the repository. The repository name may be specified on its own (such as ``nginx-web-app`` ) or it can be prepended with a namespace to group the repository into a category (such as ``project-a/nginx-web-app`` ). If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the repository name. For more information, see `Name type <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html>`_ . The repository name must start with a letter and can only contain lowercase letters, numbers, hyphens, underscores, and forward slashes. .. epigraph:: If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
         :param repository_policy_text: The JSON repository policy text to apply to the repository. For more information, see `Amazon ECR repository policies <https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html>`_ in the *Amazon Elastic Container Registry User Guide* .
@@ -2184,6 +2327,7 @@ class CfnRepository(
             encryption_configuration=encryption_configuration,
             image_scanning_configuration=image_scanning_configuration,
             image_tag_mutability=image_tag_mutability,
+            image_tag_mutability_exclusion_filters=image_tag_mutability_exclusion_filters,
             lifecycle_policy=lifecycle_policy,
             repository_name=repository_name,
             repository_policy_text=repository_policy_text,
@@ -2192,6 +2336,48 @@ class CfnRepository(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromRepositoryArn")
+    @builtins.classmethod
+    def from_repository_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        arn: builtins.str,
+    ) -> _IRepositoryRef_f3b81117:
+        '''Creates a new IRepositoryRef from an ARN.
+
+        :param scope: -
+        :param id: -
+        :param arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__6f2c393f48c21407d644d8d180231f771c0008028a3e7f9a341eb877c7400902)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+        return typing.cast(_IRepositoryRef_f3b81117, jsii.sinvoke(cls, "fromRepositoryArn", [scope, id, arn]))
+
+    @jsii.member(jsii_name="fromRepositoryName")
+    @builtins.classmethod
+    def from_repository_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        repository_name: builtins.str,
+    ) -> _IRepositoryRef_f3b81117:
+        '''Creates a new IRepositoryRef from a repositoryName.
+
+        :param scope: -
+        :param id: -
+        :param repository_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__400aec98ced3fb3a08c4f62facc37becec6934bd630cb120fe1d6d380272f46f)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument repository_name", value=repository_name, expected_type=type_hints["repository_name"])
+        return typing.cast(_IRepositoryRef_f3b81117, jsii.sinvoke(cls, "fromRepositoryName", [scope, id, repository_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -2249,6 +2435,12 @@ class CfnRepository(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="repositoryRef")
+    def repository_ref(self) -> _RepositoryReference_af4d81f0:
+        '''A reference to a Repository resource.'''
+        return typing.cast(_RepositoryReference_af4d81f0, jsii.get(self, "repositoryRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -2296,7 +2488,9 @@ class CfnRepository(
     def image_scanning_configuration(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRepository.ImageScanningConfigurationProperty"]]:
-        '''The image scanning configuration for the repository.'''
+        '''.. epigraph::
+
+   The ``imageScanningConfiguration`` parameter is being deprecated, in favor of specifying the image scanning configuration at the registry level.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRepository.ImageScanningConfigurationProperty"]], jsii.get(self, "imageScanningConfiguration"))
 
     @image_scanning_configuration.setter
@@ -2322,6 +2516,24 @@ class CfnRepository(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "imageTagMutability", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="imageTagMutabilityExclusionFilters")
+    def image_tag_mutability_exclusion_filters(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRepository.ImageTagMutabilityExclusionFilterProperty"]]]]:
+        '''A list of filters that specify which image tags are excluded from the repository's image tag mutability setting.'''
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRepository.ImageTagMutabilityExclusionFilterProperty"]]]], jsii.get(self, "imageTagMutabilityExclusionFilters"))
+
+    @image_tag_mutability_exclusion_filters.setter
+    def image_tag_mutability_exclusion_filters(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRepository.ImageTagMutabilityExclusionFilterProperty"]]]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__28c5038f217a4c1109664243a2d67cd421822e67f8352aa51ee8780d8e6fbe3e)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "imageTagMutabilityExclusionFilters", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="lifecyclePolicy")
     def lifecycle_policy(
@@ -2525,6 +2737,80 @@ class CfnRepository(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_ecr.CfnRepository.ImageTagMutabilityExclusionFilterProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "image_tag_mutability_exclusion_filter_type": "imageTagMutabilityExclusionFilterType",
+            "image_tag_mutability_exclusion_filter_value": "imageTagMutabilityExclusionFilterValue",
+        },
+    )
+    class ImageTagMutabilityExclusionFilterProperty:
+        def __init__(
+            self,
+            *,
+            image_tag_mutability_exclusion_filter_type: builtins.str,
+            image_tag_mutability_exclusion_filter_value: builtins.str,
+        ) -> None:
+            '''A filter that specifies which image tags should be excluded from the repository's image tag mutability setting.
+
+            :param image_tag_mutability_exclusion_filter_type: Specifies the type of filter to use for excluding image tags from the repository's mutability setting.
+            :param image_tag_mutability_exclusion_filter_value: The value to use when filtering image tags.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecr-repository-imagetagmutabilityexclusionfilter.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_ecr as ecr
+                
+                image_tag_mutability_exclusion_filter_property = ecr.CfnRepository.ImageTagMutabilityExclusionFilterProperty(
+                    image_tag_mutability_exclusion_filter_type="imageTagMutabilityExclusionFilterType",
+                    image_tag_mutability_exclusion_filter_value="imageTagMutabilityExclusionFilterValue"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__ca135861d33d78962bcab351d8e2048fc1f831afc1ade25d2fcc2f2024c72abd)
+                check_type(argname="argument image_tag_mutability_exclusion_filter_type", value=image_tag_mutability_exclusion_filter_type, expected_type=type_hints["image_tag_mutability_exclusion_filter_type"])
+                check_type(argname="argument image_tag_mutability_exclusion_filter_value", value=image_tag_mutability_exclusion_filter_value, expected_type=type_hints["image_tag_mutability_exclusion_filter_value"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "image_tag_mutability_exclusion_filter_type": image_tag_mutability_exclusion_filter_type,
+                "image_tag_mutability_exclusion_filter_value": image_tag_mutability_exclusion_filter_value,
+            }
+
+        @builtins.property
+        def image_tag_mutability_exclusion_filter_type(self) -> builtins.str:
+            '''Specifies the type of filter to use for excluding image tags from the repository's mutability setting.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecr-repository-imagetagmutabilityexclusionfilter.html#cfn-ecr-repository-imagetagmutabilityexclusionfilter-imagetagmutabilityexclusionfiltertype
+            '''
+            result = self._values.get("image_tag_mutability_exclusion_filter_type")
+            assert result is not None, "Required property 'image_tag_mutability_exclusion_filter_type' is missing"
+            return typing.cast(builtins.str, result)
+
+        @builtins.property
+        def image_tag_mutability_exclusion_filter_value(self) -> builtins.str:
+            '''The value to use when filtering image tags.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecr-repository-imagetagmutabilityexclusionfilter.html#cfn-ecr-repository-imagetagmutabilityexclusionfilter-imagetagmutabilityexclusionfiltervalue
+            '''
+            result = self._values.get("image_tag_mutability_exclusion_filter_value")
+            assert result is not None, "Required property 'image_tag_mutability_exclusion_filter_value' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ImageTagMutabilityExclusionFilterProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_ecr.CfnRepository.LifecyclePolicyProperty",
         jsii_struct_bases=[],
@@ -2603,7 +2889,7 @@ class CfnRepository(
             )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IRepositoryCreationTemplateRef_b7cd8f39)
 class CfnRepositoryCreationTemplate(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2635,6 +2921,10 @@ class CfnRepositoryCreationTemplate(
                 kms_key="kmsKey"
             ),
             image_tag_mutability="imageTagMutability",
+            image_tag_mutability_exclusion_filters=[ecr.CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty(
+                image_tag_mutability_exclusion_filter_type="imageTagMutabilityExclusionFilterType",
+                image_tag_mutability_exclusion_filter_value="imageTagMutabilityExclusionFilterValue"
+            )],
             lifecycle_policy="lifecyclePolicy",
             repository_policy="repositoryPolicy",
             resource_tags=[CfnTag(
@@ -2655,11 +2945,13 @@ class CfnRepositoryCreationTemplate(
         description: typing.Optional[builtins.str] = None,
         encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRepositoryCreationTemplate.EncryptionConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         image_tag_mutability: typing.Optional[builtins.str] = None,
+        image_tag_mutability_exclusion_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         lifecycle_policy: typing.Optional[builtins.str] = None,
         repository_policy: typing.Optional[builtins.str] = None,
         resource_tags: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::ECR::RepositoryCreationTemplate``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param applied_for: A list of enumerable Strings representing the repository creation scenarios that this template will apply towards. The two supported scenarios are PULL_THROUGH_CACHE and REPLICATION
@@ -2667,7 +2959,8 @@ class CfnRepositoryCreationTemplate(
         :param custom_role_arn: The ARN of the role to be assumed by Amazon ECR. Amazon ECR will assume your supplied role when the customRoleArn is specified. When this field isn't specified, Amazon ECR will use the service-linked role for the repository creation template.
         :param description: The description associated with the repository creation template.
         :param encryption_configuration: The encryption configuration associated with the repository creation template.
-        :param image_tag_mutability: The tag mutability setting for the repository. If this parameter is omitted, the default setting of MUTABLE will be used which will allow image tags to be overwritten. If IMMUTABLE is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
+        :param image_tag_mutability: The tag mutability setting for the repository. If this parameter is omitted, the default setting of ``MUTABLE`` will be used which will allow image tags to be overwritten. If ``IMMUTABLE`` is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
+        :param image_tag_mutability_exclusion_filters: A list of filters that specify which image tags are excluded from the repository creation template's image tag mutability setting.
         :param lifecycle_policy: The lifecycle policy to use for repositories created using the template.
         :param repository_policy: The repository policy to apply to repositories created using the template. A repository policy is a permissions policy associated with a repository to control access permissions.
         :param resource_tags: The metadata to apply to the repository to help you categorize and organize. Each tag consists of a key and an optional value, both of which you define. Tag keys can have a maximum character length of 128 characters, and tag values can have a maximum length of 256 characters.
@@ -2683,6 +2976,7 @@ class CfnRepositoryCreationTemplate(
             description=description,
             encryption_configuration=encryption_configuration,
             image_tag_mutability=image_tag_mutability,
+            image_tag_mutability_exclusion_filters=image_tag_mutability_exclusion_filters,
             lifecycle_policy=lifecycle_policy,
             repository_policy=repository_policy,
             resource_tags=resource_tags,
@@ -2743,6 +3037,14 @@ class CfnRepositoryCreationTemplate(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="repositoryCreationTemplateRef")
+    def repository_creation_template_ref(
+        self,
+    ) -> _RepositoryCreationTemplateReference_4a34e559:
+        '''A reference to a RepositoryCreationTemplate resource.'''
+        return typing.cast(_RepositoryCreationTemplateReference_4a34e559, jsii.get(self, "repositoryCreationTemplateRef"))
+
     @builtins.property
     @jsii.member(jsii_name="appliedFor")
     def applied_for(self) -> typing.List[builtins.str]:
@@ -2826,6 +3128,24 @@ class CfnRepositoryCreationTemplate(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "imageTagMutability", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="imageTagMutabilityExclusionFilters")
+    def image_tag_mutability_exclusion_filters(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty"]]]]:
+        '''A list of filters that specify which image tags are excluded from the repository creation template's image tag mutability setting.'''
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty"]]]], jsii.get(self, "imageTagMutabilityExclusionFilters"))
+
+    @image_tag_mutability_exclusion_filters.setter
+    def image_tag_mutability_exclusion_filters(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty"]]]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__686708849f7a8d060ba78b1f975486b8f424fe3ede8590146ea58544a5f10f12)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "imageTagMutabilityExclusionFilters", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="lifecyclePolicy")
     def lifecycle_policy(self) -> typing.Optional[builtins.str]:
@@ -2957,6 +3277,78 @@ class CfnRepositoryCreationTemplate(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_ecr.CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "image_tag_mutability_exclusion_filter_type": "imageTagMutabilityExclusionFilterType",
+            "image_tag_mutability_exclusion_filter_value": "imageTagMutabilityExclusionFilterValue",
+        },
+    )
+    class ImageTagMutabilityExclusionFilterProperty:
+        def __init__(
+            self,
+            *,
+            image_tag_mutability_exclusion_filter_type: builtins.str,
+            image_tag_mutability_exclusion_filter_value: builtins.str,
+        ) -> None:
+            '''A filter that specifies which image tags should be excluded from the repository's image tag mutability setting.
+
+            :param image_tag_mutability_exclusion_filter_type: 
+            :param image_tag_mutability_exclusion_filter_value: 
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecr-repositorycreationtemplate-imagetagmutabilityexclusionfilter.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_ecr as ecr
+                
+                image_tag_mutability_exclusion_filter_property = ecr.CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty(
+                    image_tag_mutability_exclusion_filter_type="imageTagMutabilityExclusionFilterType",
+                    image_tag_mutability_exclusion_filter_value="imageTagMutabilityExclusionFilterValue"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__86a83c57e1c4d3066aaec203ce5a6efdfad7a3c3f4adffc2b0326304ae7a11f1)
+                check_type(argname="argument image_tag_mutability_exclusion_filter_type", value=image_tag_mutability_exclusion_filter_type, expected_type=type_hints["image_tag_mutability_exclusion_filter_type"])
+                check_type(argname="argument image_tag_mutability_exclusion_filter_value", value=image_tag_mutability_exclusion_filter_value, expected_type=type_hints["image_tag_mutability_exclusion_filter_value"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "image_tag_mutability_exclusion_filter_type": image_tag_mutability_exclusion_filter_type,
+                "image_tag_mutability_exclusion_filter_value": image_tag_mutability_exclusion_filter_value,
+            }
+
+        @builtins.property
+        def image_tag_mutability_exclusion_filter_type(self) -> builtins.str:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecr-repositorycreationtemplate-imagetagmutabilityexclusionfilter.html#cfn-ecr-repositorycreationtemplate-imagetagmutabilityexclusionfilter-imagetagmutabilityexclusionfiltertype
+            '''
+            result = self._values.get("image_tag_mutability_exclusion_filter_type")
+            assert result is not None, "Required property 'image_tag_mutability_exclusion_filter_type' is missing"
+            return typing.cast(builtins.str, result)
+
+        @builtins.property
+        def image_tag_mutability_exclusion_filter_value(self) -> builtins.str:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecr-repositorycreationtemplate-imagetagmutabilityexclusionfilter.html#cfn-ecr-repositorycreationtemplate-imagetagmutabilityexclusionfilter-imagetagmutabilityexclusionfiltervalue
+            '''
+            result = self._values.get("image_tag_mutability_exclusion_filter_value")
+            assert result is not None, "Required property 'image_tag_mutability_exclusion_filter_value' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ImageTagMutabilityExclusionFilterProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_ecr.CfnRepositoryCreationTemplateProps",
@@ -2968,6 +3360,7 @@ class CfnRepositoryCreationTemplate(
         "description": "description",
         "encryption_configuration": "encryptionConfiguration",
         "image_tag_mutability": "imageTagMutability",
+        "image_tag_mutability_exclusion_filters": "imageTagMutabilityExclusionFilters",
         "lifecycle_policy": "lifecyclePolicy",
         "repository_policy": "repositoryPolicy",
         "resource_tags": "resourceTags",
@@ -2983,6 +3376,7 @@ class CfnRepositoryCreationTemplateProps:
         description: typing.Optional[builtins.str] = None,
         encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepositoryCreationTemplate.EncryptionConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         image_tag_mutability: typing.Optional[builtins.str] = None,
+        image_tag_mutability_exclusion_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
         lifecycle_policy: typing.Optional[builtins.str] = None,
         repository_policy: typing.Optional[builtins.str] = None,
         resource_tags: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]]]] = None,
@@ -2994,7 +3388,8 @@ class CfnRepositoryCreationTemplateProps:
         :param custom_role_arn: The ARN of the role to be assumed by Amazon ECR. Amazon ECR will assume your supplied role when the customRoleArn is specified. When this field isn't specified, Amazon ECR will use the service-linked role for the repository creation template.
         :param description: The description associated with the repository creation template.
         :param encryption_configuration: The encryption configuration associated with the repository creation template.
-        :param image_tag_mutability: The tag mutability setting for the repository. If this parameter is omitted, the default setting of MUTABLE will be used which will allow image tags to be overwritten. If IMMUTABLE is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
+        :param image_tag_mutability: The tag mutability setting for the repository. If this parameter is omitted, the default setting of ``MUTABLE`` will be used which will allow image tags to be overwritten. If ``IMMUTABLE`` is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
+        :param image_tag_mutability_exclusion_filters: A list of filters that specify which image tags are excluded from the repository creation template's image tag mutability setting.
         :param lifecycle_policy: The lifecycle policy to use for repositories created using the template.
         :param repository_policy: The repository policy to apply to repositories created using the template. A repository policy is a permissions policy associated with a repository to control access permissions.
         :param resource_tags: The metadata to apply to the repository to help you categorize and organize. Each tag consists of a key and an optional value, both of which you define. Tag keys can have a maximum character length of 128 characters, and tag values can have a maximum length of 256 characters.
@@ -3022,6 +3417,10 @@ class CfnRepositoryCreationTemplateProps:
                     kms_key="kmsKey"
                 ),
                 image_tag_mutability="imageTagMutability",
+                image_tag_mutability_exclusion_filters=[ecr.CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty(
+                    image_tag_mutability_exclusion_filter_type="imageTagMutabilityExclusionFilterType",
+                    image_tag_mutability_exclusion_filter_value="imageTagMutabilityExclusionFilterValue"
+                )],
                 lifecycle_policy="lifecyclePolicy",
                 repository_policy="repositoryPolicy",
                 resource_tags=[CfnTag(
@@ -3038,6 +3437,7 @@ class CfnRepositoryCreationTemplateProps:
             check_type(argname="argument description", value=description, expected_type=type_hints["description"])
             check_type(argname="argument encryption_configuration", value=encryption_configuration, expected_type=type_hints["encryption_configuration"])
             check_type(argname="argument image_tag_mutability", value=image_tag_mutability, expected_type=type_hints["image_tag_mutability"])
+            check_type(argname="argument image_tag_mutability_exclusion_filters", value=image_tag_mutability_exclusion_filters, expected_type=type_hints["image_tag_mutability_exclusion_filters"])
             check_type(argname="argument lifecycle_policy", value=lifecycle_policy, expected_type=type_hints["lifecycle_policy"])
             check_type(argname="argument repository_policy", value=repository_policy, expected_type=type_hints["repository_policy"])
             check_type(argname="argument resource_tags", value=resource_tags, expected_type=type_hints["resource_tags"])
@@ -3053,6 +3453,8 @@ class CfnRepositoryCreationTemplateProps:
             self._values["encryption_configuration"] = encryption_configuration
         if image_tag_mutability is not None:
             self._values["image_tag_mutability"] = image_tag_mutability
+        if image_tag_mutability_exclusion_filters is not None:
+            self._values["image_tag_mutability_exclusion_filters"] = image_tag_mutability_exclusion_filters
         if lifecycle_policy is not None:
             self._values["lifecycle_policy"] = lifecycle_policy
         if repository_policy is not None:
@@ -3117,13 +3519,24 @@ class CfnRepositoryCreationTemplateProps:
     def image_tag_mutability(self) -> typing.Optional[builtins.str]:
         '''The tag mutability setting for the repository.
 
-        If this parameter is omitted, the default setting of MUTABLE will be used which will allow image tags to be overwritten. If IMMUTABLE is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
+        If this parameter is omitted, the default setting of ``MUTABLE`` will be used which will allow image tags to be overwritten. If ``IMMUTABLE`` is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repositorycreationtemplate.html#cfn-ecr-repositorycreationtemplate-imagetagmutability
         '''
         result = self._values.get("image_tag_mutability")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def image_tag_mutability_exclusion_filters(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty]]]]:
+        '''A list of filters that specify which image tags are excluded from the repository creation template's image tag mutability setting.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repositorycreationtemplate.html#cfn-ecr-repositorycreationtemplate-imagetagmutabilityexclusionfilters
+        '''
+        result = self._values.get("image_tag_mutability_exclusion_filters")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty]]]], result)
+
     @builtins.property
     def lifecycle_policy(self) -> typing.Optional[builtins.str]:
         '''The lifecycle policy to use for repositories created using the template.
@@ -3177,6 +3590,7 @@ class CfnRepositoryCreationTemplateProps:
         "encryption_configuration": "encryptionConfiguration",
         "image_scanning_configuration": "imageScanningConfiguration",
         "image_tag_mutability": "imageTagMutability",
+        "image_tag_mutability_exclusion_filters": "imageTagMutabilityExclusionFilters",
         "lifecycle_policy": "lifecyclePolicy",
         "repository_name": "repositoryName",
         "repository_policy_text": "repositoryPolicyText",
@@ -3191,6 +3605,7 @@ class CfnRepositoryProps:
         encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.EncryptionConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         image_scanning_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.ImageScanningConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         image_tag_mutability: typing.Optional[builtins.str] = None,
+        image_tag_mutability_exclusion_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.ImageTagMutabilityExclusionFilterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
         lifecycle_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.LifecyclePolicyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         repository_name: typing.Optional[builtins.str] = None,
         repository_policy_text: typing.Any = None,
@@ -3200,8 +3615,9 @@ class CfnRepositoryProps:
 
         :param empty_on_delete: If true, deleting the repository force deletes the contents of the repository. If false, the repository must be empty before attempting to delete it.
         :param encryption_configuration: The encryption configuration for the repository. This determines how the contents of your repository are encrypted at rest.
-        :param image_scanning_configuration: The image scanning configuration for the repository. This determines whether images are scanned for known vulnerabilities after being pushed to the repository.
+        :param image_scanning_configuration: .. epigraph:: The ``imageScanningConfiguration`` parameter is being deprecated, in favor of specifying the image scanning configuration at the registry level. For more information, see ``PutRegistryScanningConfiguration`` . The image scanning configuration for the repository. This determines whether images are scanned for known vulnerabilities after being pushed to the repository.
         :param image_tag_mutability: The tag mutability setting for the repository. If this parameter is omitted, the default setting of ``MUTABLE`` will be used which will allow image tags to be overwritten. If ``IMMUTABLE`` is specified, all image tags within the repository will be immutable which will prevent them from being overwritten.
+        :param image_tag_mutability_exclusion_filters: A list of filters that specify which image tags are excluded from the repository's image tag mutability setting.
         :param lifecycle_policy: Creates or updates a lifecycle policy. For information about lifecycle policy syntax, see `Lifecycle policy template <https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html>`_ .
         :param repository_name: The name to use for the repository. The repository name may be specified on its own (such as ``nginx-web-app`` ) or it can be prepended with a namespace to group the repository into a category (such as ``project-a/nginx-web-app`` ). If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the repository name. For more information, see `Name type <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html>`_ . The repository name must start with a letter and can only contain lowercase letters, numbers, hyphens, underscores, and forward slashes. .. epigraph:: If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
         :param repository_policy_text: The JSON repository policy text to apply to the repository. For more information, see `Amazon ECR repository policies <https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html>`_ in the *Amazon Elastic Container Registry User Guide* .
@@ -3230,6 +3646,10 @@ class CfnRepositoryProps:
                     scan_on_push=False
                 ),
                 image_tag_mutability="imageTagMutability",
+                image_tag_mutability_exclusion_filters=[ecr.CfnRepository.ImageTagMutabilityExclusionFilterProperty(
+                    image_tag_mutability_exclusion_filter_type="imageTagMutabilityExclusionFilterType",
+                    image_tag_mutability_exclusion_filter_value="imageTagMutabilityExclusionFilterValue"
+                )],
                 lifecycle_policy=ecr.CfnRepository.LifecyclePolicyProperty(
                     lifecycle_policy_text="lifecyclePolicyText",
                     registry_id="registryId"
@@ -3248,6 +3668,7 @@ class CfnRepositoryProps:
             check_type(argname="argument encryption_configuration", value=encryption_configuration, expected_type=type_hints["encryption_configuration"])
             check_type(argname="argument image_scanning_configuration", value=image_scanning_configuration, expected_type=type_hints["image_scanning_configuration"])
             check_type(argname="argument image_tag_mutability", value=image_tag_mutability, expected_type=type_hints["image_tag_mutability"])
+            check_type(argname="argument image_tag_mutability_exclusion_filters", value=image_tag_mutability_exclusion_filters, expected_type=type_hints["image_tag_mutability_exclusion_filters"])
             check_type(argname="argument lifecycle_policy", value=lifecycle_policy, expected_type=type_hints["lifecycle_policy"])
             check_type(argname="argument repository_name", value=repository_name, expected_type=type_hints["repository_name"])
             check_type(argname="argument repository_policy_text", value=repository_policy_text, expected_type=type_hints["repository_policy_text"])
@@ -3261,6 +3682,8 @@ class CfnRepositoryProps:
             self._values["image_scanning_configuration"] = image_scanning_configuration
         if image_tag_mutability is not None:
             self._values["image_tag_mutability"] = image_tag_mutability
+        if image_tag_mutability_exclusion_filters is not None:
+            self._values["image_tag_mutability_exclusion_filters"] = image_tag_mutability_exclusion_filters
         if lifecycle_policy is not None:
             self._values["lifecycle_policy"] = lifecycle_policy
         if repository_name is not None:
@@ -3300,9 +3723,13 @@ class CfnRepositoryProps:
     def image_scanning_configuration(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnRepository.ImageScanningConfigurationProperty]]:
-        '''The image scanning configuration for the repository.
+        '''.. epigraph::
+
+   The ``imageScanningConfiguration`` parameter is being deprecated, in favor of specifying the image scanning configuration at the registry level.
 
-        This determines whether images are scanned for known vulnerabilities after being pushed to the repository.
+        For more information, see ``PutRegistryScanningConfiguration`` .
+
+        The image scanning configuration for the repository. This determines whether images are scanned for known vulnerabilities after being pushed to the repository.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repository.html#cfn-ecr-repository-imagescanningconfiguration
         '''
@@ -3320,6 +3747,17 @@ class CfnRepositoryProps:
         result = self._values.get("image_tag_mutability")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def image_tag_mutability_exclusion_filters(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRepository.ImageTagMutabilityExclusionFilterProperty]]]]:
+        '''A list of filters that specify which image tags are excluded from the repository's image tag mutability setting.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repository.html#cfn-ecr-repository-imagetagmutabilityexclusionfilters
+        '''
+        result = self._values.get("image_tag_mutability_exclusion_filters")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRepository.ImageTagMutabilityExclusionFilterProperty]]]], result)
+
     @builtins.property
     def lifecycle_policy(
         self,
@@ -3949,6 +4387,39 @@ class _IRepositoryProxy(
 typing.cast(typing.Any, IRepository).__jsii_proxy_class__ = lambda : _IRepositoryProxy
 
 
+class ImageTagMutabilityExclusionFilter(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_ecr.ImageTagMutabilityExclusionFilter",
+):
+    '''Represents an image tag mutability exclusion filter for ECR repository.
+
+    :exampleMetadata: infused
+
+    Example::
+
+        # Make all tags immutable except for those starting with 'dev-' or 'test-'
+        ecr.Repository(self, "Repo",
+            image_tag_mutability=ecr.TagMutability.IMMUTABLE_WITH_EXCLUSION,
+            image_tag_mutability_exclusion_filters=[
+                ecr.ImageTagMutabilityExclusionFilter.wildcard("dev-*"),
+                ecr.ImageTagMutabilityExclusionFilter.wildcard("test-*")
+            ]
+        )
+    '''
+
+    @jsii.member(jsii_name="wildcard")
+    @builtins.classmethod
+    def wildcard(cls, pattern: builtins.str) -> "ImageTagMutabilityExclusionFilter":
+        '''Creates a wildcard filter for image tag mutability exclusion.
+
+        :param pattern: The wildcard pattern to match image tags (e.g., 'dev-*', 'release-v*').
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__506e41b81658bfe386f74207c24c3216542f105c02a9deeef0aa17031ffd52ef)
+            check_type(argname="argument pattern", value=pattern, expected_type=type_hints["pattern"])
+        return typing.cast("ImageTagMutabilityExclusionFilter", jsii.sinvoke(cls, "wildcard", [pattern]))
+
+
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_ecr.LifecycleRule",
     jsii_struct_bases=[],
@@ -5058,6 +5529,7 @@ class RepositoryLookupOptions:
         "encryption_key": "encryptionKey",
         "image_scan_on_push": "imageScanOnPush",
         "image_tag_mutability": "imageTagMutability",
+        "image_tag_mutability_exclusion_filters": "imageTagMutabilityExclusionFilters",
         "lifecycle_registry_id": "lifecycleRegistryId",
         "lifecycle_rules": "lifecycleRules",
         "removal_policy": "removalPolicy",
@@ -5071,9 +5543,10 @@ class RepositoryProps:
         auto_delete_images: typing.Optional[builtins.bool] = None,
         empty_on_delete: typing.Optional[builtins.bool] = None,
         encryption: typing.Optional[RepositoryEncryption] = None,
-        encryption_key: typing.Optional[_IKey_5f11635f] = None,
+        encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         image_scan_on_push: typing.Optional[builtins.bool] = None,
         image_tag_mutability: typing.Optional["TagMutability"] = None,
+        image_tag_mutability_exclusion_filters: typing.Optional[typing.Sequence[ImageTagMutabilityExclusionFilter]] = None,
         lifecycle_registry_id: typing.Optional[builtins.str] = None,
         lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
@@ -5086,6 +5559,7 @@ class RepositoryProps:
         :param encryption_key: External KMS key to use for repository encryption. The 'encryption' property must be either not specified or set to "KMS". An error will be emitted if encryption is set to "AES256". Default: - If encryption is set to ``KMS`` and this property is undefined, an AWS managed KMS key is used.
         :param image_scan_on_push: Enable the scan on push when creating the repository. Default: false
         :param image_tag_mutability: The tag mutability setting for the repository. If this parameter is omitted, the default setting of MUTABLE will be used which will allow image tags to be overwritten. Default: TagMutability.MUTABLE
+        :param image_tag_mutability_exclusion_filters: The image tag mutability exclusion filters for the repository. These filters specify which image tags can override the repository's default image tag mutability setting. Default: undefined - AWS ECR default is no exclusion filters
         :param lifecycle_registry_id: The AWS account ID associated with the registry that contains the repository. Default: The default registry is assumed.
         :param lifecycle_rules: Life cycle rules to apply to this registry. Default: No life cycle rules
         :param removal_policy: Determine what happens to the repository when the resource/stack is deleted. Default: RemovalPolicy.Retain
@@ -5095,7 +5569,17 @@ class RepositoryProps:
 
         Example::
 
-            ecr.Repository(self, "Repo", image_tag_mutability=ecr.TagMutability.IMMUTABLE)
+            repository = ecr.Repository(self, "TestRepository",
+                repository_name="test-agent-runtime"
+            )
+            agent_runtime_artifact = agentcore.AgentRuntimeArtifact.from_ecr_repository(repository, "v1.0.0")
+            
+            # Explicitly using public network (this is the default)
+            runtime = agentcore.Runtime(self, "MyAgentRuntime",
+                runtime_name="myAgent",
+                agent_runtime_artifact=agent_runtime_artifact,
+                network_configuration=agentcore.RuntimeNetworkConfiguration.using_public_network()
+            )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__638b63dd5eb589e01019ee47c63d6335810d02b0d769f767f2bf2fddc285af28)
@@ -5105,6 +5589,7 @@ class RepositoryProps:
             check_type(argname="argument encryption_key", value=encryption_key, expected_type=type_hints["encryption_key"])
             check_type(argname="argument image_scan_on_push", value=image_scan_on_push, expected_type=type_hints["image_scan_on_push"])
             check_type(argname="argument image_tag_mutability", value=image_tag_mutability, expected_type=type_hints["image_tag_mutability"])
+            check_type(argname="argument image_tag_mutability_exclusion_filters", value=image_tag_mutability_exclusion_filters, expected_type=type_hints["image_tag_mutability_exclusion_filters"])
             check_type(argname="argument lifecycle_registry_id", value=lifecycle_registry_id, expected_type=type_hints["lifecycle_registry_id"])
             check_type(argname="argument lifecycle_rules", value=lifecycle_rules, expected_type=type_hints["lifecycle_rules"])
             check_type(argname="argument removal_policy", value=removal_policy, expected_type=type_hints["removal_policy"])
@@ -5122,6 +5607,8 @@ class RepositoryProps:
             self._values["image_scan_on_push"] = image_scan_on_push
         if image_tag_mutability is not None:
             self._values["image_tag_mutability"] = image_tag_mutability
+        if image_tag_mutability_exclusion_filters is not None:
+            self._values["image_tag_mutability_exclusion_filters"] = image_tag_mutability_exclusion_filters
         if lifecycle_registry_id is not None:
             self._values["lifecycle_registry_id"] = lifecycle_registry_id
         if lifecycle_rules is not None:
@@ -5170,7 +5657,7 @@ class RepositoryProps:
         return typing.cast(typing.Optional[RepositoryEncryption], result)
 
     @builtins.property
-    def encryption_key(self) -> typing.Optional[_IKey_5f11635f]:
+    def encryption_key(self) -> typing.Optional[_IKeyRef_d4fc6ef3]:
         '''External KMS key to use for repository encryption.
 
         The 'encryption' property must be either not specified or set to "KMS".
@@ -5182,7 +5669,7 @@ class RepositoryProps:
         an AWS managed KMS key is used.
         '''
         result = self._values.get("encryption_key")
-        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+        return typing.cast(typing.Optional[_IKeyRef_d4fc6ef3], result)
 
     @builtins.property
     def image_scan_on_push(self) -> typing.Optional[builtins.bool]:
@@ -5204,6 +5691,21 @@ class RepositoryProps:
         result = self._values.get("image_tag_mutability")
         return typing.cast(typing.Optional["TagMutability"], result)
 
+    @builtins.property
+    def image_tag_mutability_exclusion_filters(
+        self,
+    ) -> typing.Optional[typing.List[ImageTagMutabilityExclusionFilter]]:
+        '''The image tag mutability exclusion filters for the repository.
+
+        These filters specify which image tags can override the repository's default image tag mutability setting.
+
+        :default: undefined - AWS ECR default is no exclusion filters
+
+        :see: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html
+        '''
+        result = self._values.get("image_tag_mutability_exclusion_filters")
+        return typing.cast(typing.Optional[typing.List[ImageTagMutabilityExclusionFilter]], result)
+
     @builtins.property
     def lifecycle_registry_id(self) -> typing.Optional[builtins.str]:
         '''The AWS account ID associated with the registry that contains the repository.
@@ -5267,13 +5769,24 @@ class TagMutability(enum.Enum):
 
     Example::
 
-        ecr.Repository(self, "Repo", image_tag_mutability=ecr.TagMutability.IMMUTABLE)
+        # Make all tags immutable except for those starting with 'dev-' or 'test-'
+        ecr.Repository(self, "Repo",
+            image_tag_mutability=ecr.TagMutability.IMMUTABLE_WITH_EXCLUSION,
+            image_tag_mutability_exclusion_filters=[
+                ecr.ImageTagMutabilityExclusionFilter.wildcard("dev-*"),
+                ecr.ImageTagMutabilityExclusionFilter.wildcard("test-*")
+            ]
+        )
     '''
 
     MUTABLE = "MUTABLE"
     '''allow image tags to be overwritten.'''
     IMMUTABLE = "IMMUTABLE"
     '''all image tags within the repository will be immutable which will prevent them from being overwritten.'''
+    IMMUTABLE_WITH_EXCLUSION = "IMMUTABLE_WITH_EXCLUSION"
+    '''all image tags within the repository will be immutable, while allowing you to define some filters for tags that can be changed.'''
+    MUTABLE_WITH_EXCLUSION = "MUTABLE_WITH_EXCLUSION"
+    '''allow image tags to be overwritten while allowing you to define some filters for tags that should remain unchanged.'''
 
 
 @jsii.enum(jsii_type="aws-cdk-lib.aws_ecr.TagStatus")
@@ -5299,19 +5812,15 @@ class Repository(
 
     Example::
 
-        import aws_cdk.aws_lambda as lambda_
-        from aws_cdk.aws_events_targets import LambdaFunction
-        
-        
-        repo = ecr.Repository(self, "Repo")
-        lambda_handler = lambda_.Function(self, "LambdaFunction",
-            runtime=lambda_.Runtime.PYTHON_3_12,
-            code=lambda_.Code.from_inline("# dummy func"),
-            handler="index.handler"
+        repository = ecr.Repository(self, "TestRepository",
+            repository_name="test-agent-runtime"
         )
+        agent_runtime_artifact = agentcore.AgentRuntimeArtifact.from_ecr_repository(repository, "v1.0.0")
         
-        repo.on_event("OnEventTargetLambda",
-            target=LambdaFunction(lambda_handler)
+        runtime = agentcore.Runtime(self, "MyAgentRuntime",
+            runtime_name="myAgent",
+            agent_runtime_artifact=agent_runtime_artifact,
+            authorizer_configuration=agentcore.RuntimeAuthorizerConfiguration.using_oAuth("https://github.com/.well-known/openid-configuration", "oauth_client_123")
         )
     '''
 
@@ -5323,9 +5832,10 @@ class Repository(
         auto_delete_images: typing.Optional[builtins.bool] = None,
         empty_on_delete: typing.Optional[builtins.bool] = None,
         encryption: typing.Optional[RepositoryEncryption] = None,
-        encryption_key: typing.Optional[_IKey_5f11635f] = None,
+        encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
         image_scan_on_push: typing.Optional[builtins.bool] = None,
         image_tag_mutability: typing.Optional[TagMutability] = None,
+        image_tag_mutability_exclusion_filters: typing.Optional[typing.Sequence[ImageTagMutabilityExclusionFilter]] = None,
         lifecycle_registry_id: typing.Optional[builtins.str] = None,
         lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
@@ -5340,6 +5850,7 @@ class Repository(
         :param encryption_key: External KMS key to use for repository encryption. The 'encryption' property must be either not specified or set to "KMS". An error will be emitted if encryption is set to "AES256". Default: - If encryption is set to ``KMS`` and this property is undefined, an AWS managed KMS key is used.
         :param image_scan_on_push: Enable the scan on push when creating the repository. Default: false
         :param image_tag_mutability: The tag mutability setting for the repository. If this parameter is omitted, the default setting of MUTABLE will be used which will allow image tags to be overwritten. Default: TagMutability.MUTABLE
+        :param image_tag_mutability_exclusion_filters: The image tag mutability exclusion filters for the repository. These filters specify which image tags can override the repository's default image tag mutability setting. Default: undefined - AWS ECR default is no exclusion filters
         :param lifecycle_registry_id: The AWS account ID associated with the registry that contains the repository. Default: The default registry is assumed.
         :param lifecycle_rules: Life cycle rules to apply to this registry. Default: No life cycle rules
         :param removal_policy: Determine what happens to the repository when the resource/stack is deleted. Default: RemovalPolicy.Retain
@@ -5356,6 +5867,7 @@ class Repository(
             encryption_key=encryption_key,
             image_scan_on_push=image_scan_on_push,
             image_tag_mutability=image_tag_mutability,
+            image_tag_mutability_exclusion_filters=image_tag_mutability_exclusion_filters,
             lifecycle_registry_id=lifecycle_registry_id,
             lifecycle_rules=lifecycle_rules,
             removal_policy=removal_policy,
@@ -5534,6 +6046,12 @@ class Repository(
             check_type(argname="argument statement", value=statement, expected_type=type_hints["statement"])
         return typing.cast(_AddToResourcePolicyResult_1d0a53ad, jsii.invoke(self, "addToResourcePolicy", [statement]))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="PROPERTY_INJECTION_ID")
+    def PROPERTY_INJECTION_ID(cls) -> builtins.str:
+        '''Uniquely identifies this class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "PROPERTY_INJECTION_ID"))
+
     @builtins.property
     @jsii.member(jsii_name="repositoryArn")
     def repository_arn(self) -> builtins.str:
@@ -5564,6 +6082,7 @@ __all__ = [
     "CfnRepositoryCreationTemplateProps",
     "CfnRepositoryProps",
     "IRepository",
+    "ImageTagMutabilityExclusionFilter",
     "LifecycleRule",
     "OnCloudTrailImagePushedOptions",
     "OnImageScanCompletedOptions",
@@ -5598,6 +6117,22 @@ def _typecheckingstub__a5b1b0a44f7b903d10d3e873896cf1709943b67e3503cc3918e4e98f0
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__df08363dd3d49b4b281729649cda34a42b796ed2c1c7a9e6c28145049dcd5bf9(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__a12c8d1af48bfd21b0af8b54f0dfaf211699928aac8fb0ffb2e0ff8ce482ac1a(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    repository_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__317b166576f7593305ca27885da5cd7a621d59c15390c40d8de8d3e3c28eb94b(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -5894,6 +6429,7 @@ def _typecheckingstub__0c4027f87eb46bfdc341ea831d36476b6bcb3d7c3adf8e4193a6f82d2
     encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.EncryptionConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     image_scanning_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.ImageScanningConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     image_tag_mutability: typing.Optional[builtins.str] = None,
+    image_tag_mutability_exclusion_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.ImageTagMutabilityExclusionFilterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     lifecycle_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.LifecyclePolicyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     repository_name: typing.Optional[builtins.str] = None,
     repository_policy_text: typing.Any = None,
@@ -5902,6 +6438,22 @@ def _typecheckingstub__0c4027f87eb46bfdc341ea831d36476b6bcb3d7c3adf8e4193a6f82d2
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__6f2c393f48c21407d644d8d180231f771c0008028a3e7f9a341eb877c7400902(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__400aec98ced3fb3a08c4f62facc37becec6934bd630cb120fe1d6d380272f46f(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    repository_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__2248718d73b3c7bcee12085148b85f05a4c458576be92459e450678dd33ba17a(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -5938,6 +6490,12 @@ def _typecheckingstub__6d75698f85ccefe489f53d4f155b619c9c3df1026fe201828f3f0ccc7
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__28c5038f217a4c1109664243a2d67cd421822e67f8352aa51ee8780d8e6fbe3e(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRepository.ImageTagMutabilityExclusionFilterProperty]]]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__47418c52de9eb82b5a96dfa3524d84345309cf3a2f06fbbc30eaa7da852a33fa(
     value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnRepository.LifecyclePolicyProperty]],
 ) -> None:
@@ -5977,6 +6535,14 @@ def _typecheckingstub__c75cd2b6ec01cb2a5879c051b4088257f2aa69c2f3db3f6435eba0c0b
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__ca135861d33d78962bcab351d8e2048fc1f831afc1ade25d2fcc2f2024c72abd(
+    *,
+    image_tag_mutability_exclusion_filter_type: builtins.str,
+    image_tag_mutability_exclusion_filter_value: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__e19a186a43de423097984e8a515b442413c2fa31fe895650e26f9f349987264e(
     *,
     lifecycle_policy_text: typing.Optional[builtins.str] = None,
@@ -5995,6 +6561,7 @@ def _typecheckingstub__494445c3594e6c48becf87b896b56289e6923275ed1be048e55a955aa
     description: typing.Optional[builtins.str] = None,
     encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepositoryCreationTemplate.EncryptionConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     image_tag_mutability: typing.Optional[builtins.str] = None,
+    image_tag_mutability_exclusion_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     lifecycle_policy: typing.Optional[builtins.str] = None,
     repository_policy: typing.Optional[builtins.str] = None,
     resource_tags: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]]]] = None,
@@ -6050,6 +6617,12 @@ def _typecheckingstub__0d03ac6e7b2975934cbd1c8b2470015fc671509b1b82834732e60abe4
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__686708849f7a8d060ba78b1f975486b8f424fe3ede8590146ea58544a5f10f12(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty]]]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__e2e08b01e66ab87aacff8f76d06c2abf47c27bd4366b69a73969d43a0b0b636a(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -6076,6 +6649,14 @@ def _typecheckingstub__0f48a77de88f0d76d55768806e65efb655f325c51435a78fe46978432
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__86a83c57e1c4d3066aaec203ce5a6efdfad7a3c3f4adffc2b0326304ae7a11f1(
+    *,
+    image_tag_mutability_exclusion_filter_type: builtins.str,
+    image_tag_mutability_exclusion_filter_value: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__623a27e5bf9e58dfa2c0c25d5b312731cce32386963e30de33e3bd636fb982d3(
     *,
     applied_for: typing.Sequence[builtins.str],
@@ -6084,6 +6665,7 @@ def _typecheckingstub__623a27e5bf9e58dfa2c0c25d5b312731cce32386963e30de33e3bd636
     description: typing.Optional[builtins.str] = None,
     encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepositoryCreationTemplate.EncryptionConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     image_tag_mutability: typing.Optional[builtins.str] = None,
+    image_tag_mutability_exclusion_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepositoryCreationTemplate.ImageTagMutabilityExclusionFilterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     lifecycle_policy: typing.Optional[builtins.str] = None,
     repository_policy: typing.Optional[builtins.str] = None,
     resource_tags: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]]]] = None,
@@ -6097,6 +6679,7 @@ def _typecheckingstub__6887f05f59c4e061f761607002ffdf5b7ad09f76abbf4b7be49513c3e
     encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.EncryptionConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     image_scanning_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.ImageScanningConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     image_tag_mutability: typing.Optional[builtins.str] = None,
+    image_tag_mutability_exclusion_filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.ImageTagMutabilityExclusionFilterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     lifecycle_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRepository.LifecyclePolicyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     repository_name: typing.Optional[builtins.str] = None,
     repository_policy_text: typing.Any = None,
@@ -6210,6 +6793,12 @@ def _typecheckingstub__894e1dc0284d8788d4bcf980d7755525e14fbcec8b305670af1a388f3
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__506e41b81658bfe386f74207c24c3216542f105c02a9deeef0aa17031ffd52ef(
+    pattern: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__daefc01ac58c056180e96357fa989faf5de713c6f5bd46bb023e2579bcaf8de0(
     *,
     description: typing.Optional[builtins.str] = None,
@@ -6397,9 +6986,10 @@ def _typecheckingstub__638b63dd5eb589e01019ee47c63d6335810d02b0d769f767f2bf2fddc
     auto_delete_images: typing.Optional[builtins.bool] = None,
     empty_on_delete: typing.Optional[builtins.bool] = None,
     encryption: typing.Optional[RepositoryEncryption] = None,
-    encryption_key: typing.Optional[_IKey_5f11635f] = None,
+    encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     image_scan_on_push: typing.Optional[builtins.bool] = None,
     image_tag_mutability: typing.Optional[TagMutability] = None,
+    image_tag_mutability_exclusion_filters: typing.Optional[typing.Sequence[ImageTagMutabilityExclusionFilter]] = None,
     lifecycle_registry_id: typing.Optional[builtins.str] = None,
     lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
@@ -6415,9 +7005,10 @@ def _typecheckingstub__0fcb489ea7ac91914ff0429ef13d64f8bd29978872d9ce4754ee9d397
     auto_delete_images: typing.Optional[builtins.bool] = None,
     empty_on_delete: typing.Optional[builtins.bool] = None,
     encryption: typing.Optional[RepositoryEncryption] = None,
-    encryption_key: typing.Optional[_IKey_5f11635f] = None,
+    encryption_key: typing.Optional[_IKeyRef_d4fc6ef3] = None,
     image_scan_on_push: typing.Optional[builtins.bool] = None,
     image_tag_mutability: typing.Optional[TagMutability] = None,
+    image_tag_mutability_exclusion_filters: typing.Optional[typing.Sequence[ImageTagMutabilityExclusionFilter]] = None,
     lifecycle_registry_id: typing.Optional[builtins.str] = None,
     lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
@@ -6475,3 +7066,6 @@ def _typecheckingstub__a4c2e425a71ed909d2a0bfefe861aad7c34b251f3ef1f93f5dd7f2be5
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [IRepository]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])