# Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third-party provider

- Source: https://support.icompaas.com/support/solutions/articles/62000234222-ensure-image-vulnerability-scanning-using-amazon-ecr-image-scanning-or-a-third-party-provider-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon EKS](https://support.icompaas.com/support/solutions/62000112685) › [CIS Amazon Elastic Kubernetes Service (EKS) Benchmark](https://support.icompaas.com/support/solutions/folders/62000169234)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** **• Level 1**

**Description:** Scan images being deployed to Amazon EKS for vulnerabilities using Amazon ECR's built-in scanning functionality or a third-party image scanning provider.

Rationale: Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to cloud resources. Amazon ECR and other third-party providers allow images to be scanned for known vulnerabilities, providing a proactive defense against security risks.

**Impact:  
 Pros:**

-   Enhanced security by identifying and mitigating vulnerabilities in container images before deployment.
    
-   Reduces risk of deploying compromised or vulnerable images into production.
    

**Cons:**

-   Scanning may result in delays in deployment, particularly with large images or when scanning a large number of images.
    
-   Unsupported images (e.g., Docker scratch images) will not be scanned.
    

Common image scan failures:

-   UnsupportedImageError: Occurs when scanning images built with unsupported operating systems.
    
-   UNDEFINED severity level: Can occur if the vulnerability is not assigned a recognized priority.
    

**Default Value:** By default, images are not scanned.

**Pre-requisites:**

-   Access to Amazon ECR or a third-party image scanning provider.
    
-   Proper IAM permissions to configure scanning settings in ECR.
    

### **Remediation**

**Test Plan:**

**Using AWS CLI:**

1.  To create a repository with image scanning enabled on push:
    

aws ecr create-repository --repository-name $REPO\_NAME --image-scanning-configuration scanOnPush=true --region $REGION\_CODE

2.  To edit an existing repository’s settings to enable scanning on push:
    

aws ecr put-image-scanning-configuration --repository-name $REPO\_NAME --image-scanning-configuration scanOnPush=true --region $REGION\_CODE

**Using AWS Console:**

1.  Open the Amazon ECR console at [ECR Console](https://console.aws.amazon.com/ecr/repositories).
    
2.  Choose the region where you want to create or configure the repository.
    
3.  Select the repository containing the image to scan.
    
4.  On the Images page, select the image to scan and click Scan.
    

### **Implementation Plan**

**Using AWS CLI:**

1.  Create a repository with scanning on push enabled using the command provided in the remediation section.
    
2.  Edit the scanning configuration of an existing repository to enable image scanning on push.
    

**Using AWS Console:**

1.  Create a repository with image scanning on push enabled through the Amazon ECR Console.
    
2.  Alternatively, manually trigger image scanning for existing images via the Console.
    

### **Backout Plan**

**Using AWS CLI:**

1.  To disable image scanning on push, use the following command:
    

aws ecr put-image-scanning-configuration --repository-name $REPO\_NAME --image-scanning-configuration scanOnPush=false --region $REGION\_CODE

2.  If necessary, delete the repository or restore previous configurations.
    

**Using AWS Console:**

1.  Navigate to the ECR Console and modify the image scanning settings.
    
2.  Revert to previous configurations if required.
    

### **References:**

1.  [Amazon ECR Image Scanning Documentation  
    ](https://docs.aws.amazon.com/AmazonECR/latest/userguide/imagescanning.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.