API

Amazon ECR should be scanning all images for vulnerabilities

Docs > Datadog Security > OOTB Rules > Amazon ECR should be scanning all images for vulnerabilities

This rule is part of a beta feature. To learn more, contact Support.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

Container images should be scanned for vulnerabilities prior to deployment to an EKS cluster. Scanning for vulnerabilities and remediating them prior to a deployment can increase your security posture for your EKS cluster.

Note: If you use a different scanning tool for images, this rule can be muted or turned off.

Remediation

For each ECR repository, do the following:

  aws ecr create-repository --repository-name <repo-name> \
  --image-scanning-configuration scanOnPush=true \
  --region <region-name>