All checks
High
ECR private repositories should have image scanning configured
Verifies that private ECR repositories are covered by a scan on push or continuous scanning rule (manual scanning does not count), so images are checked for known vulnerabilities without anyone starting a scan. The rules are registry-wide, so one rule can clear every repository's finding in the Region.
- service
- ECR
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
Elastic Container Registry → Private registry → Scanning configuration
With the AWS CLI
aws ecr put-registry-scanning-configuration --scan-type BASIC --rules '[{"scanFrequency":"SCAN_ON_PUSH","repositoryFilters":[{"filter":"*","filterType":"WILDCARD"}]}]' --region <region>With Terraform
resource "aws_ecr_registry_scanning_configuration" "this" {
scan_type = "BASIC"
rule {
scan_frequency = "SCAN_ON_PUSH"
repository_filter {
filter = "*"
filter_type = "WILDCARD"
}
}
}See which of your accounts this check is failing on.
Book a demo