ECR repository must have image scan on push enabled

High AWS General aws-ecr-repository-ecr-repository-image-scan

Applies to

AWS::ECR::Repository

What CGPulse checks

A resource passes this rule when imageScanOnPush must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable scan on push to automatically detect vulnerabilities in container images. In AWS Console: ECR > Repositories > select repo > Edit > enable Scan on push. See: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html

CLI

aws ecr put-image-scanning-configuration --repository-name "{name}" --image-scanning-configuration scanOnPush=true

Terraform

resource "aws_ecr_repository" "{name}" {
  image_scanning_configuration {
    scan_on_push = true
  }
}

Compliance frameworks

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan