Description

Ensure that the Amazon Elastic Container Registry (ECR) private registry in each region that contains repositories has a registry-level scanning rule that applies to all repositories, either with no repository filter or with the wildcard filter *, so that pushed images are scanned automatically. Both basic and enhanced scanning are accepted, and the scan frequency of the rule (scan on push or continuous scanning) is not verified. Registries with no repositories are not evaluated.

Rationale

Without scan on push, or with scan rules that only cover some repositories, container images with known vulnerabilities can be pushed and deployed without being detected. Attackers can exploit these vulnerabilities for remote code execution, privilege escalation or lateral movement, and compromised base images can spread through the software supply chain. Enabling scan on push for all repositories, preferably with enhanced scanning, gives early visibility of vulnerable images so that they can be blocked before they reach production.

Impact

  • Every image pushed to the registry is scanned for known vulnerabilities

  • Scan findings can be used in CI/CD pipelines to stop vulnerable images from being deployed

  • Enhanced scanning uses Amazon Inspector and is charged per image scanned; basic scanning has no additional charge

  • Changing the registry scanning configuration replaces all existing scan rules in that region

Default Value

The private registry uses basic scanning by default, with no registry-level scan rules configured, so images are not scanned automatically on push for all repositories.

Pre-Requisites

  • IAM permissions: ecr:DescribeRepositories, ecr:GetRegistryScanningConfiguration and ecr:PutRegistryScanningConfiguration

  • For enhanced scanning: permissions to enable Amazon Inspector (for example inspector2:Enable) and agreement on the related cost

  • A list of the regions where ECR repositories exist

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ECR console.

  3. In the left menu, under Private registry, open the registry settings and select Scanning.

  4. Check the Scanning configuration and confirm that a scan rule exists whose repository filter is * or empty, so that it applies to all repositories. Scan on push (or Continuous scanning with enhanced scanning) is the recommended frequency, but the frequency of the rule is not verified.

  5. Repeat for each region in use that contains ECR repositories.

  6. If no such rule exists, follow the implementation steps.

CLI:

Check whether the region contains any repositories:

aws ecr describe-repositories --region <REGION> --query "repositories[].repositoryName"

Show the registry scanning configuration:

aws ecr get-registry-scanning-configuration --region <REGION> --query "scanningConfiguration.[scanType,rules]"

A region that contains at least one repository fails if the rules list is empty, or if every rule has a repositoryFilters list that does not contain the filter *. Regions with no repositories are not evaluated, repository-level scan on push settings are not considered, and the scan frequency of a rule is not verified.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ECR console.

  3. In the left menu, under Private registry, open the registry settings and select Scanning.

  4. Choose Edit.

  5. Select the scanning type:

    • Enhanced scanning (recommended, uses Amazon Inspector), or

    • Basic scanning.

  6. Enable Scan on push (or Continuous scanning for enhanced scanning) and set the repository filter to * so that the rule applies to all repositories.

  7. Choose Save.

  8. Repeat for each region in use that contains ECR repositories.

CLI:

Enable scan on push for all repositories with basic scanning. The repository filter in the original command used a literal placeholder value, so it is replaced with the wildcard *:

aws ecr put-registry-scanning-configuration --region <REGION> --scan-type BASIC --rules 'scanFrequency=SCAN_ON_PUSH,repositoryFilters=[{filter=*,filterType=WILDCARD}]'

To use enhanced scanning instead:

aws ecr put-registry-scanning-configuration --region <REGION> --scan-type ENHANCED --rules 'scanFrequency=SCAN_ON_PUSH,repositoryFilters=[{filter=*,filterType=WILDCARD}]'

Backout Plan

Before making changes, save the current scanning configuration:

aws ecr get-registry-scanning-configuration --region <REGION> > registry-scanning-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ECR console.

  3. In the left menu, under Private registry, open the registry settings and select Scanning.

  4. Choose Edit and set the scanning type and scan rules back to the values in the saved backup.

  5. Choose Save.

Note: rolling back allows images to be pushed without an automatic vulnerability scan again.

Reference