Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third party provider

Cómo se verifica

Método de auditoría: Comando de shell

out=$(aws ecr get-registry-scanning-configuration --query '[scanningConfiguration.scanType, length(scanningConfiguration.rules || `[]`)]' --output text) || exit 1
set -- $out
if [ "$1" = ENHANCED ] || [ "${2:-0}" -gt 0 ]; then echo compliant; else echo "noncompliant: $out"; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Enable image vulnerability scanning in ECR for the repositories that supply container images to EKS workloads. Configure scanning at the private registry level in each Region, because ECR manages scan behavior through registry settings. Prefer Enhanced Scanning so Amazon Inspector can continuously scan container images for operating system and programming language package vulnerabilities. If Basic Scanning is used instead, ensure the repositories that store EKS images are covered by scan on push rules or are manually scanned before image promotion and deployment. EKS guidance recommends regularly scanning images in ECR or with a commercial scanner, and AWS notes that the older repository-level put-image-scanning-configuration path is being deprecated in favor of registry-level configuration. • Identify the ECR repositories and Regions that provide images to EKS workloads.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target eks