AWS ECR Image Tags using Python Lambda Function

I am using a python lambda function to add an image tag to ECR images using boto3. The following code works and adds the desired tag to the specified image. However, targeting a different image with a different test event removes the previously applied tag from the last image. I have tried 3 different repos, as well as cross account and local account lambda functions.

For example, these are three image tags within repository "test-repo":

1. 1.0.0.1
2. 1.0.0.2
3. 1.0.0.3

I run the test event for 1.0.0.1, and the following tags are now present:

1. DELETEON_2020-03-06, 1.0.0.1
2. 1.0.0.2
3. 1.0.0.3

When I run the test event for any other image, in this example 1.0.0.2, this is what happens:

1. 1.0.0.1
2. DELETEON_2020-03-06, 1.0.0.2
3. 1.0.0.3

I would expect the code to apply the tag to 1.0.0.1, and then when I run it for 1.0.0.2, it just adds the tag to that image as well. I don't see why it is removing the previously applied tag. I need to be able to apply the DELETEON tag to all identified vulnerable images. Is there something I am not seeing or understanding about the boto3 ECR methods, ECR itself, or perhaps this is a bug?

    import json
    import boto3
    import datetime
    from datetime import timedelta

    def lambda_handler(event, context):
        acct = event['account']
        date = datetime.date.today()
        repo = event['detail']['repository-name']
        digest = event['detail']['image-digest']
        imagetag = event['detail']['image-tags'][0]
        client = boto3.client('ecr')
        dayint = datetime.date.today() + datetime.timedelta(days=3)
        deletetag = dayint.strftime("%Y-%m-%d")

        response = client.batch_get_image(
            registryId=acct,
            repositoryName=repo,
            imageIds=[
                {
                    'imageDigest': digest,
                    'imageTag': imagetag
                }
            ]
        )
        putresponse = client.put_image(
                    registryId=acct,
                    repositoryName=repo,
                    imageManifest=response['images'][0]['imageManifest'],
                    imageTag='DELETEON_' + deletetag
                )

Here is the sample test event (I switch out the image-digest and image-tag to target different images in the same repo):

{
  "version": "0",
  "id": "1111111111-22222222222-3333333333333",
  "detail-type": "ECR Image Scan",
  "source": "aws.ecr",
  "account": "111111111111",
  "time": "2020-02-14T22:41:19Z",
  "region": "us-east-1",
  "resources": [
    "arn:aws:ecr:us-east-1:111111111111:repository/test-repo"
  ],
  "detail": {
    "scan-status": "COMPLETE",
    "repository-name": "test-repo",
    "image-digest": "sha256:111111111111111111111111111111111111111111111111111",
    "image-tags": [
      "1.0.0.1"
    ],
    "finding-severity-counts": {
      "HIGH": 12,
      "MEDIUM": 46,
      "INFORMATIONAL": 84,
      "LOW": 72,
      "UNDEFINED": 6
    }
  }
}