# Ensure ECR Repository Image Contains No Hardcoded Secrets

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890032264780-ensure-ecr-repository-image-contains-no-hardcoded-secrets
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that container images stored in Amazon ECR repositories are scanned for embedded secrets, such as API keys, private keys, passwords, or access tokens hardcoded into application code, configuration files, or environment defaults baked into image layers, and that no such secrets are present.

**Rationale**

Secrets hardcoded into a container image are baked into every layer of that image and are trivially extractable by anyone who can pull the image, including through container registry access, image export, or inspection of intermediate layers, even if the secret is later removed from the final running container's visible filesystem. Regularly scanning images for embedded secrets (using ECR enhanced scanning or a dedicated secret-scanning tool as part of the CI/CD pipeline) helps catch this class of exposure before an image is deployed or made available for pull.

**Impact**

-   Reduces the risk of credential leakage via container images pulled by developers, CI/CD systems, or, if the repository is misconfigured, external parties
    
-   Encourages secrets to be injected at runtime via a secrets manager or environment injection rather than baked into the image
    
-   Requires integrating secret scanning into the build pipeline and establishing a remediation process for findings
    

**Default Value**

ECR does not scan for embedded secrets by default; basic scanning (CVE-focused) may be enabled, but secret detection specifically requires ECR enhanced scanning (powered by Amazon Inspector) or an external secret-scanning tool.

**Pre-Requisites**

-   Amazon ECR enhanced scanning enabled (via Amazon Inspector) for the repository, or an equivalent third-party image secret-scanning tool integrated into the pipeline
    
-   IAM permissions to configure ECR scanning settings (ecr:PutRegistryScanningConfiguration) and to view scan findings (inspector2:ListFindings)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon ECR > Registry settings > Scanning configuration, and verify Enhanced scanning is enabled for the relevant repositories.
    
3.  Navigate to Amazon Inspector > Findings and filter for the target repository's images.
    
4.  Review findings for any secret-related exposures (for example, findings identifying embedded credentials, if supported, or cross-reference with a dedicated secrets-scanning tool's report).
    
5.  Verify no unresolved findings indicate a hardcoded secret in an active image.
    
6.  If hardcoded secrets are found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon ECR > Registry settings > Scanning configuration and enable Enhanced scanning for the repository (or repositories) in scope, ensuring Amazon Inspector is enabled for the account.
    
3.  Integrate a secret-scanning step (for example, a dedicated open-source or commercial secret scanner) into the CI/CD pipeline to scan the image or its build context prior to push, failing the build if a secret is detected.
    
4.  For any existing image found to contain a hardcoded secret, immediately rotate the exposed credential.
    
5.  Remove the secret from the application code or configuration, and rebuild and re-push the image using runtime secret injection (for example, via AWS Secrets Manager or environment variables populated at deploy time) instead.
    
6.  Delete or restrict pull access to the previously affected image tag/digest once a corrected image has been deployed.
    

**Backout Plan**

1.  Disabling secret scanning is not recommended; if it must be temporarily disabled for operational reasons, navigate to Amazon ECR > Registry settings > Scanning configuration and revert to Basic scanning or disable Enhanced scanning.
    
2.  Remove the secret-scanning step from the CI/CD pipeline if it must be temporarily removed.
    

**Reference**

-   [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html)
    
-   [https://docs.aws.amazon.com/inspector/latest/user/enable-disable-scanning-ecr.html](https://docs.aws.amazon.com/inspector/latest/user/enable-disable-scanning-ecr.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.