aquasecurity / aquasecurity/cloudsploit
ECR - Scan on push at the repository level deprecated
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
The plugin [Amazon ECR Scan on Push](https://github.com/aquasecurity/cloudsploit/blob/master/plugins/aws/ecr/ecrImageVulnerability.js) is using **ECR:describe-repositories.imageScanningConfiguration.scanOnPush** to determine if Scan on Push is enabled in a repository. Nevertheless, repository level scan on push setting was deprecated in favor of Registry level scan on push filters.
**'imageScanningConfiguration.scanOnPush'** shouldn`t be used anymore to test if scan on push is enabled. Although at the repository level scanOnPush = False, at the registry level scanning might enabled and including repositories due to the values in the filters.
A new logic should be built based on the scan filters at the registry level.
**'batch-get-repository-scanning-configuration.appliedScanFilters'** would return the filters applied. One possible test is to verify if a wildcard "*" is used, which would include all repositories in the registry. Another logic would be applying the filter to the repository names to determine the ones excluded.
Contributor guide
Research direction
Start in plugins/aws/ecr/ecrImageVulnerability.js and review how the plugin currently uses ECR:describe-repositories.imageScanningConfiguration.scanOnPush. Then inspect batch-get-repository-scanning-configuration.appliedScanFilters and determine how those filters include or exclude repository names. Done means the scan-on-push check reflects registry-level filters rather than the deprecated repository setting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100