ECR repositories should be encrypted with customer managed AWS KMS keys
Flags ECR repositories not encrypted at rest with a customer managed KMS key. The baseline is one of two materially different positions, and the repository's encryption setting says which: AES256 is S3-style encryption with no KMS key at all, while KMS with no key named uses the AWS managed aws/ecr key, which is visible in KMS and records its use in CloudTrail but whose policy you cannot edit.
- service
- ECR
- severity
- Low
- scope
- evaluated in every region
How to fix it
Set at creation: fixing it means replacing the resource.
Set the repository's encryptionConfiguration to KMS with a key you own. This cannot be changed on an existing repository, so the route is a new repository created with the key named and the images re-pushed to it. AES256, the default, is already encrypted: what the key adds is a key policy you write and the ability to revoke.
In the console
ECR → Repositories → Create repository → Encryption settings → KMS
With the AWS CLI
aws ecr create-repository --repository-name <name> --encryption-configuration encryptionType=KMS,kmsKey=<kms-key-arn>With Terraform
resource "aws_ecr_repository" "this" {
name = var.repository_name
encryption_configuration {
encryption_type = "KMS"
kms_key = var.kms_key_arn
}
}See which of your accounts this check is failing on.
Book a demo