All 7 Elastic Container Registry (ECR) questions
More in Elastic Container Registry (ECR)
What is Amazon Elastic Container Registry and how does it fit into a containerized application workflow? How do you authenticate Docker to push and pull images from a private ECR repository? How can ECR repository policies control which IAM users, roles, or other AWS accounts can access a specific container image repository? How do ECR lifecycle policies help automatically manage and clean up old or unused container images to control storage costs? How can ECR pull through cache repositories simplify managing dependencies on public container registries while maintaining private, controlled access? How should an organization design a comprehensive container image governance strategy across multiple ECR repositories, teams, and AWS accounts?
Advertisement
Back to results for “CI/CD”
AWS › Elastic Container Registry (ECR)

How does ECR image scanning help identify security vulnerabilities within container images before they are deployed?

Intermediate

Answer

ECR image scanning automatically analyzes the operating system packages and, with enhanced scanning enabled, application dependencies within a container image against known vulnerability databases, flagging any identified vulnerabilities along with their severity level, which can be configured to run automatically every time a new image is pushed, giving teams visibility into security risks before a vulnerable image is ever deployed to production.
aws ecr start-image-scan --repository-name my-app --image-id imageTag=latest
Real-world example A security conscious development team enables automatic scanning on push for their ECR repositories, catching a critical vulnerability in a base image dependency before that image is ever deployed to their production ECS cluster.

Common follow-ups: What is the difference between basic scanning and enhanced scanning in ECR?;How do you integrate ECR scan results into a CI/CD pipeline to block deployment of vulnerable images?

AWS Security Hub & GuardDuty;AWS CodePipeline CodeBuild & CodeDeploy (CI/CD)
All 7 Elastic Container Registry (ECR) questions