API

Amazon ECR should be scanning all images for vulnerabilities

문서 > Datadog 보안 > OOTB Rules > Amazon ECR should be scanning all images for vulnerabilities

This rule is part of a beta feature. To learn more, contact Support.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

Container images should be scanned for vulnerabilities prior to deployment to an EKS cluster. Scanning for vulnerabilities and remediating them prior to a deployment can increase your security posture for your EKS cluster.

Note: If you use a different scanning tool for images, this rule can be muted or turned off.

Remediation

For each ECR repository, do the following:

  aws ecr create-repository --repository-name <repo-name> \
  --image-scanning-configuration scanOnPush=true \
  --region <region-name>