aquasecurity / aquasecurity/cloudsploit

ECR - Scan on push at the repository level deprecated

Open
#1,905 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

The plugin [Amazon ECR Scan on Push](https://github.com/aquasecurity/cloudsploit/blob/master/plugins/aws/ecr/ecrImageVulnerability.js) is using **ECR:describe-repositories.imageScanningConfiguration.scanOnPush** to determine if Scan on Push is enabled in a repository. Nevertheless, repository level scan on push setting was deprecated in favor of Registry level scan on push filters.

**'imageScanningConfiguration.scanOnPush'** shouldn`t be used anymore to test if scan on push is enabled. Although at the repository level scanOnPush = False, at the registry level scanning might enabled and including repositories due to the values in the filters.

A new logic should be built based on the scan filters at the registry level.

**'batch-get-repository-scanning-configuration.appliedScanFilters'** would return the filters applied. One possible test is to verify if a wildcard "*" is used, which would include all repositories in the registry. Another logic would be applying the filter to the repository names to determine the ones excluded.

Contributor guide

Open the contributing guide

Research direction

Start in plugins/aws/ecr/ecrImageVulnerability.js and review how the plugin currently uses ECR:describe-repositories.imageScanningConfiguration.scanOnPush. Then inspect batch-get-repository-scanning-configuration.appliedScanFilters and determine how those filters include or exclude repository names. Done means the scan-on-push check reflects registry-level filters rather than the deprecated repository setting.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.