Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third party provider

So wird geprüft

Prüfmethode: Shell-Befehl

out=$(aws ecr get-registry-scanning-configuration --query '[scanningConfiguration.scanType, length(scanningConfiguration.rules || `[]`)]' --output text) || exit 1
set -- $out
if [ "$1" = ENHANCED ] || [ "${2:-0}" -gt 0 ]; then echo compliant; else echo "noncompliant: $out"; fi

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Enable image vulnerability scanning in ECR for the repositories that supply container images to EKS workloads. Configure scanning at the private registry level in each Region, because ECR manages scan behavior through registry settings. Prefer Enhanced Scanning so Amazon Inspector can continuously scan container images for operating system and programming language package vulnerabilities. If Basic Scanning is used instead, ensure the repositories that store EKS images are covered by scan on push rules or are manually scanned before image promotion and deployment. EKS guidance recommends regularly scanning images in ECR or with a commercial scanner, and AWS notes that the older repository-level put-image-scanning-configuration path is being deprecated in favor of registry-level configuration. • Identify the ECR repositories and Regions that provide images to EKS workloads.

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target eks