Amazon ECR should be scanning all images for vulnerabilities

This rule is part of a beta feature. To learn more, contact Support.
ecr
This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

Container images should be scanned for vulnerabilities prior to deployment to an EKS cluster. Scanning for vulnerabilities and remediating them prior to a deployment can increase your security posture for your EKS cluster.

Note: If you use a different scanning tool for images, this rule can be muted or turned off.

Remediation

For each ECR repository, do the following:

  aws ecr create-repository --repository-name <repo-name> \
  --image-scanning-configuration scanOnPush=true \
  --region <region-name>