# Check if ECR image scan found vulnerabilities in the newest image version

- Source: https://support.icompaas.com/support/solutions/articles/62000224194-check-if-ecr-image-scan-found-vulnerabilities-in-the-newest-image-version
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

#### **Description:** 

Amazon Elastic Container Registry (ECR) is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images. Amazon ECR is integrated with Amazon Elastic Container Service (ECS), simplifying your development to production workflow. 

#### **Rationale:** 

Need to Identify any exposed ECR repositories in the environment and make sure repository access is not set to public. Amazon ECR currently supports private images. However, using IAM resource-based permissions, you can configure policies for each repository to allow access to IAM users, roles, or other AWS accounts. 

####   
**Impact:**

Each container image may be scanned once per 24 hours. If scan on push is disabled on a repository, then you must manually start each image scan to get the scan results. When a new repository is configured to scan on push, all new images pushed to the repository will be scanned.

#### **Default Value:**

You can manually scan container images stored in Amazon ECR. Or you can configure your repositories to scan images when you push them to a repository.

#### **Pre-requisites:**

1.  Private/Public Repository 
    
2.  An Amazon ECR image repository contains your Docker images, Open Container Initiative (OCI) images, and OCI compatible artifacts.
    
3.   A public repository is open to publicly pull images from and is visible on the Amazon ECR Public Gallery
    

#### **Remediation**:

**Test Plan:**

1.  Sign in to the Amazon Management Console
    
2.  Go to the Amazon ECR Console at  [https://console.aws.amazon.com/ecr](https://console.aws.amazon.com/ecr "https://console.aws.amazon.com/ecr")
    
3.  In the left menu, select **Repositories** in Amazon ECR
    
4.  Select the repository you want to audit
    
5.  Find the latest image, check whether the vulnerabilities status is active or not  ![](https://support.icompaas.com/assets/kb/3ff53cc9524d4009.png)  
    

  

  

**Using AWS CLI:**

1.  The following CLI displays the results of an image, in the repository specified in the account.
    
    aws ecr describe-images \\  
        --repository-name cluster-autoscaler \\  
        --image-ids imageTag=v1.13.6
    

  

  

**Implementation steps:**

1.  Sign in to the Amazon Management Console
    
    1.  Go to the Amazon ECR Console at  [https://console.aws.amazon.com/ecr](https://console.aws.amazon.com/ecr "https://console.aws.amazon.com/ecr")
        
    2.  In the left menu, select **Repositories** in Amazon ECR
        
2.  Select the Repository you want to modify
    
3.  Find the **latest image**, in that you will find **details** in the vulnerabilities column 
    
4.  By clicking on details you can find the vulnerabilities of the latest version ![](https://support.icompaas.com/assets/kb/6eb507ad2043e4d1.png)
    

  

  

**Using AWS CLI:**

1.  The following CLI displays the complete image details and their vulnerabilities.
    
    aws ecr describe-image-scan-findings \\  
        --repository-name sample-repo \\  
        --image-id imageDigest=sha256:74b2c688c700ec95a93e478cdb959737c148df3fbf5ea706abe0318726e885e6
    
      
    
      
    
    **Backoutplan:**
    
    1.  Open the Amazon Inspector console at [https://console.aws.amazon.com/inspector/v2/home](https://console.aws.amazon.com/inspector/v2/home "https://console.aws.amazon.com/inspector/v2/home").
        
    2.  Use the Region selector in the upper right to specify the Region where you want to disable scans.
        
    3.  In the navigation pane, choose **Settings**, and then choose **Account Management**.
        
    4.  Choose the **Accounts** tab to see the scan status of an account.
        
    5.  Select the check box for the account or accounts for which you want to disable scans.
        
    6.  From the **Actions** drop-down, select the scan type to disable.
        
    
      
    
    **Using AWS CLI:**
    
    aws inspector2 disable --resource-types ECR
    
      
    
    **Reference:**
    
    1.  [![](https://support.icompaas.com/assets/kb/37b4e400762fe8d0.png)describe-images — AWS CLI 1.23.0 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/ecr/describe-images.html) 
        
    2.  [![](https://support.icompaas.com/assets/kb/7a8e9faecba75d88.png)Image scanning - Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) 
        
    3.  [![](https://support.icompaas.com/assets/kb/7439fcd2e746cba6.png)Scanning Amazon ECR container images with Amazon Inspector - Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/enable-disable-scanning-ecr.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.