aws-samples / aws-samples/cdk-eks-blueprints-patterns

Show vulnerable ECR images in use

Open
#75 2 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted
Dominant language
TypeScript
Stars
178
Forks
166
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
Images stored in ECR are scanned with Inspector2 for security vulnerabilities. When new vulnerabilities are detected in images, I would like to know which of the affected images are currently in use in any of the deployed EKS clusters. This will help evaluate the attack surface and prioritize the efforts for remediating the security threats.

**Describe the solution you'd like**
As a part of the security pattern configuring container image vulnerability scanning with Amazon inspector, we can create an EventBridge event that will be triggered every time a new EKS cluster is created. The event will asynchronously invoke an Orchestrator Lambda that will create an Image-Verifier Lambda function specific to a particular EKS cluster. The Image-Verifier Lambda function will be invoked every time a new vulnerability is detected by Inspector2 and will check if any of the affected images are currently in use in a specific EKS cluster. In case the image is in use, the Image-Verifier Lambda will use SNS to notify interested parties.

**Describe alternatives you've considered**
We can utilize partner solutions as an alternative.

**Additional context**
Add any other context or screenshots about the feature request here.

Contributor guide

Open the contributing guide

Research direction

Start by locating the repository's existing security-pattern entry points and the Amazon Inspector vulnerability-scanning pattern. Trace how EventBridge, the Orchestrator Lambda, the Image-Verifier Lambda, EKS, ECR, and SNS would connect. Done means affected images are checked against deployed EKS clusters and interested parties are notified when a vulnerable image is in use.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, typescript
Domain
cloud, devops, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.