aws-samples / aws-samples/cdk-eks-blueprints-patterns
Show vulnerable ECR images in use
- Dominant language
- TypeScript
- Stars
- 178
- Forks
- 166
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
Images stored in ECR are scanned with Inspector2 for security vulnerabilities. When new vulnerabilities are detected in images, I would like to know which of the affected images are currently in use in any of the deployed EKS clusters. This will help evaluate the attack surface and prioritize the efforts for remediating the security threats.
**Describe the solution you'd like**
As a part of the security pattern configuring container image vulnerability scanning with Amazon inspector, we can create an EventBridge event that will be triggered every time a new EKS cluster is created. The event will asynchronously invoke an Orchestrator Lambda that will create an Image-Verifier Lambda function specific to a particular EKS cluster. The Image-Verifier Lambda function will be invoked every time a new vulnerability is detected by Inspector2 and will check if any of the affected images are currently in use in a specific EKS cluster. In case the image is in use, the Image-Verifier Lambda will use SNS to notify interested parties.
**Describe alternatives you've considered**
We can utilize partner solutions as an alternative.
**Additional context**
Add any other context or screenshots about the feature request here.
Contributor guide
Research direction
Start by locating the repository's existing security-pattern entry points and the Amazon Inspector vulnerability-scanning pattern. Trace how EventBridge, the Orchestrator Lambda, the Image-Verifier Lambda, EKS, ECR, and SNS would connect. Done means affected images are checked against deployed EKS clusters and interested parties are notified when a vulnerable image is in use.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes, typescript
- Domain
- cloud, devops, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100