Amazon Inspector ECR scanning should be enabled

How to fix it

Have Amazon Inspector ECR scanning activated in every Region where the account holds ECR repositories. Activating it switches the private registry in that Region from ECR basic scanning, which costs nothing and covers operating system packages only, to Inspector enhanced scanning, which also covers programming language packages and is billed per image scanned on push plus each rescan of an image still held.

In the console

Amazon Inspector → Account management → Activate → ECR scanning

With the AWS CLI

aws inspector2 enable --resource-types ECR --region <region>

With Terraform

resource "aws_inspector2_enabler" "this" {
  account_ids    = [data.aws_caller_identity.current.account_id]
  resource_types = ["ECR"]
}