# Ensure the ECR registry has a scanning rule that covers all repositories

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292208235883-ensure-the-ecr-registry-has-a-scanning-rule-that-covers-all-repositories
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the Amazon Elastic Container Registry (ECR) private registry in each region that contains repositories has a registry-level scanning rule that applies to all repositories, either with no repository filter or with the wildcard filter \*, so that pushed images are scanned automatically. Both basic and enhanced scanning are accepted, and the scan frequency of the rule (scan on push or continuous scanning) is not verified. Registries with no repositories are not evaluated.

**Rationale**

Without scan on push, or with scan rules that only cover some repositories, container images with known vulnerabilities can be pushed and deployed without being detected. Attackers can exploit these vulnerabilities for remote code execution, privilege escalation or lateral movement, and compromised base images can spread through the software supply chain. Enabling scan on push for all repositories, preferably with enhanced scanning, gives early visibility of vulnerable images so that they can be blocked before they reach production.

**Impact**

-   Every image pushed to the registry is scanned for known vulnerabilities
    
-   Scan findings can be used in CI/CD pipelines to stop vulnerable images from being deployed
    
-   Enhanced scanning uses Amazon Inspector and is charged per image scanned; basic scanning has no additional charge
    
-   Changing the registry scanning configuration replaces all existing scan rules in that region
    

**Default Value**

The private registry uses basic scanning by default, with no registry-level scan rules configured, so images are not scanned automatically on push for all repositories.

**Pre-Requisites**

-   IAM permissions: ecr:DescribeRepositories, ecr:GetRegistryScanningConfiguration and ecr:PutRegistryScanningConfiguration
    
-   For enhanced scanning: permissions to enable Amazon Inspector (for example inspector2:Enable) and agreement on the related cost
    
-   A list of the regions where ECR repositories exist
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon ECR console.
    
3.  In the left menu, under **Private registry**, open the registry settings and select **Scanning**.
    
4.  Check the **Scanning configuration** and confirm that a scan rule exists whose repository filter is \* or empty, so that it applies to all repositories. **Scan on push** (or **Continuous scanning** with enhanced scanning) is the recommended frequency, but the frequency of the rule is not verified.
    
5.  Repeat for each region in use that contains ECR repositories.
    
6.  If no such rule exists, follow the implementation steps.
    

**CLI:**

Check whether the region contains any repositories:

aws ecr describe-repositories --region <REGION> --query "repositories\[\].repositoryName"

Show the registry scanning configuration:

aws ecr get-registry-scanning-configuration --region <REGION> --query "scanningConfiguration.\[scanType,rules\]"

A region that contains at least one repository fails if the rules list is empty, or if every rule has a repositoryFilters list that does not contain the filter \*. Regions with no repositories are not evaluated, repository-level scan on push settings are not considered, and the scan frequency of a rule is not verified.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon ECR console.
    
3.  In the left menu, under **Private registry**, open the registry settings and select **Scanning**.
    
4.  Choose **Edit**.
    
5.  Select the scanning type:
    
    -   **Enhanced scanning** (recommended, uses Amazon Inspector), or
        
    -   **Basic scanning**.
        
6.  Enable **Scan on push** (or **Continuous scanning** for enhanced scanning) and set the repository filter to \* so that the rule applies to all repositories.
    
7.  Choose **Save**.
    
8.  Repeat for each region in use that contains ECR repositories.
    

**CLI:**

Enable scan on push for all repositories with basic scanning. The repository filter in the original command used a literal placeholder value, so it is replaced with the wildcard \*:

aws ecr put-registry-scanning-configuration --region <REGION> --scan-type BASIC --rules 'scanFrequency=SCAN\_ON\_PUSH,repositoryFilters=\[{filter=\*,filterType=WILDCARD}\]'

To use enhanced scanning instead:

aws ecr put-registry-scanning-configuration --region <REGION> --scan-type ENHANCED --rules 'scanFrequency=SCAN\_ON\_PUSH,repositoryFilters=\[{filter=\*,filterType=WILDCARD}\]'

**Backout Plan**

Before making changes, save the current scanning configuration:

aws ecr get-registry-scanning-configuration --region <REGION> > registry-scanning-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon ECR console.
    
3.  In the left menu, under **Private registry**, open the registry settings and select **Scanning**.
    
4.  Choose **Edit** and set the scanning type and scan rules back to the values in the saved backup.
    
5.  Choose **Save**.
    

Note: rolling back allows images to be pushed without an automatic vulnerability scan again.

**Reference**

-   [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html)
    
-   [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-basic.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-basic.html)
    
-   [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/ecr/put-registry-scanning-configuration.html](https://docs.aws.amazon.com/cli/latest/reference/ecr/put-registry-scanning-configuration.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.