AWS Private ECR repository policy is overly permissive misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_32
Category - Subcategory	IAM - Permissions
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	8ce95833-8811-4ab6-b475-d8c9a59dbca6

Impact

This rule identifies AWS Private ECR repositories that have overly permissive registry policies. An ECR(Elastic Container Registry) repository is a collection of Docker images available on the AWS cloud. These images might contain sensitive information which should be restricted to unauthorized users.

How to Fix

Resource: AWS::ECR::Repository

• Argument: Properties.RepositoryPolicyText.Statement.Principal [source,go]

---

Resources: MyRepository: Type: AWS::ECR::Repository Properties: ... RepositoryPolicyText: ... Statement:

• ...
• Principal: "*"
• Principal:
• AWS:
• • "arn:aws:iam::123456789012:user/Bob"
• • ...

---