# Minimize user access to Amazon ECR

- Source: https://support.icompaas.com/support/solutions/articles/62000234233-minimize-user-access-to-amazon-ecr-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon EKS](https://support.icompaas.com/support/solutions/62000112685) › [CIS Amazon Elastic Kubernetes Service (EKS) Benchmark](https://support.icompaas.com/support/solutions/folders/62000169234)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** • **Level 1**

**Description:**  
Ensure that container images deployed to Amazon EKS are scanned for vulnerabilities using Amazon ECR image scanning or a third-party provider. Regular scanning helps identify and mitigate security risks associated with vulnerabilities in the software packages used by the images. 

**Rationale:** Vulnerabilities in container images can be exploited by attackers to gain unauthorized access to cloud resources. Using image scanning tools like Amazon ECR image scanning or third-party providers ensures that images are checked for known vulnerabilities before deployment, enhancing the overall security of the Kubernetes environment. 

**Impact:  
 Pros:**

-   Prevents unauthorized access and manipulation of container images.
    
-   Reduces the risk of malicious code injection or the accidental deployment of insecure images.
    

**Cons:**

-   Requires careful management of IAM policies to avoid accidentally denying necessary access for legitimate users.
    

### **Remediation**

**Test Plan:**

**Using AWS Console:**

1.  Go to Amazon ECR in the AWS Console.
2.  Verify that image scanning is enabled for each repository under Image Scanning Configuration.

**Using AWS CLI:**

1.  Run the following command to check if image scanning is enabled for a repository:  
      
    
    aws ecr describe-repositories --repository-names <REPO\_NAME> --region <REGION\_CODE>
    

###         2. Ensure that scanOnPush is set to `true`.

### **Implementation Plan**

**Using AWS Console:**

1.  Open the Amazon ECR Console and navigate to Repositories.
    
2.  Select the repository and enable image scanning for new images by clicking Edit and ensuring Scan on Push is enabled.
    

**Using AWS CLI:**

1.  To enable image scanning, run:`   `
    
    aws ecr put-image-scanning-configuration --repository-name <REPO\_NAME> --image-scanning-configuration scanOnPush=true --region <REGION\_CODE>
    
2.  Apply to all relevant repositories that store container images.
    

### **Backout Plan**

**Using AWS Console:**

1.  Revert to previous IAM policies if a mistake is made.
    
2.  Ensure only the correct policies are reattached to users and service accounts.
    

**Using AWS CLI:**

1.  Use the command to remove any incorrect or overly permissive IAM policies.
    

 aws iam delete-policy

2.  Attach the correct, least-privilege policies to the appropriate users.
    

### **References:**

1.  [Amazon ECR Image Scanning Documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/imagescanning.html#scanning-repository)
    
2.  [AWS IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.