Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third party provider

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Amazon ECR registry-level scanning controls how container images are scanned for vulnerabilities. This rule verifies that the ECR registry has at least one scanning rule with a valid scan frequency (SCAN_ON_PUSH or CONTINUOUS_SCAN) so images are continuously assessed for known vulnerabilities before they are pulled into EKS workloads. Leaving image scanning disabled allows vulnerable images to be deployed, increasing the attack surface of the environment.

Remediation

Enable enhanced or basic scanning on the ECR registry with an appropriate scan frequency so that all repositories are continuously assessed for vulnerabilities. See the Amazon ECR image scanning documentation for configuration steps.

References