For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-r89.md. A documentation index is available at /llms.txt.

Amazon ECR should be scanning all images for vulnerabilities

This rule is part of a beta feature. To learn more, contact Support.
ecr

Description

Container images should be scanned for vulnerabilities prior to deployment to an EKS cluster. Scanning for vulnerabilities and remediating them prior to a deployment can increase your security posture for your EKS cluster.

Note: If you use a different scanning tool for images, this rule can be muted or turned off.

Remediation

For each ECR repository, do the following:

  aws ecr create-repository --repository-name <repo-name> \
  --image-scanning-configuration scanOnPush=true \
  --region <region-name>