ECR registry has automated image scanning enabled for all repositories
ecr_registry_scan_images_on_push_enabled
Amazon ECR registries with repositories are evaluated for automated image scanning at the registry level -- scan on push or continuous scanning -- with scan rules that cover all repositories (no restrictive filters), for either basic or enhanced scanning. A registry whose rules specify only MANUAL scanning does not scan pushed images.
Risk
Without automated registry scanning, vulnerable images are pushed and deployed without timely detection, enabling exploitation of known CVEs (RCE, privilege escalation), supply chain compromise, and lateral movement - threatening workload integrity and data confidentiality. Repository filters narrow the same risk to whichever repositories they exclude.
prowler aws --checks ecr_registry_scan_images_on_push_enabled
Recommendation
Enable registry-wide scan on push and ensure rules apply to all repositories (no filters). Prefer enhanced scanning for broader coverage, and pair with continuous scans when available. Integrate findings into CI/CD gates and alerts to enforce defense in depth and block promotion of risky images.
Remediation
aws ecr put-registry-scanning-configuration --rules 'scanFrequency=SCAN_ON_PUSH,repositoryFilters=[{filter=string,filterType=WILDCARD}]'
- Open the AWS Management Console and go to Amazon ECR
- In the left menu, click Account settings (or Settings), then find Registry scanning
- Click Edit
- Set Scanning type to Enhanced scanning
- Enable Scan on push
- Under Repository filters, set Filter type to WILDCARD and Filter to *
- Click Save
Source Code
Resource Type
Other