Creating a retention policy

Now that we have some ways to track image metadata with each build, the next step is to design a retention policy. Retention times largely depend on compliance standards for your industry, but it never hurts to have an overprotective policy. Some Financial Conduct Authority guidelines say platform records should be kept for at least five years. Some more strict organizations may require seven years. Say we need a maximum retention of seven years for all image data. We determine that images must be retained for seven years but they can be compressed and archived after two years. We can establish these guidelines in a simple standard:

1. At three months of age, an image shall be deprecated for new deployments.
2. At one year of age, all deployed instances of an image should be terminated.
3. At two years of age, an image shall be compressed and archived in cold storage.
4. At seven years of age, an image can finally be purged.

...