ECR image scan on push is not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_163
Category - Subcategory	Compute - Default Credentials Or Auth
Provider	AWS
Severity	HIGH
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Amazon ECR is a fully managed container registry used to store, manage and deploy container images. ECR Image Scanning assesses and identifies operating system vulnerabilities. Using automated image scans you can ensure container image vulnerabilities are found before getting pushed to production. ECR APIs notify if vulnerabilities were found when a scan completes.

How to Fix

Resource: AWS::ECR::Repository

• Arguments: Properties.ImageScanningConfiguration.ScanOnPush - (Required) Indicates whether images are scanned after being pushed to the repository (true) or not scanned (false). [source,go]

---

Resources: ImageScanTrue: Type: AWS::ECR::Repository Properties: ...

• ImageScanningConfiguration:
• ScanOnPush: true

---