[ECS/ECR] [request]: Ability to lookup ECS tasks across AWS accounts running with vulnerable container images

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

Regarding ECR’s image scanning, we have to find which tasks are actually using the container image which got reported that it has vulns in it. It would be great if we can lookup and/or list-up the tasks (and the services which refer to them) across AWS accounts from within the ECR management console.

and/or

It’s good if it just includes “Here is a task/service list which are using this vulnerable image” in the ECR events.

**Which service(s) is this request for?**

ECS, ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

The ECR image scanning feature can report images’ vulns for us but we have to find out by ourselves whether we have running tasks with that image, by looking around the ECS console or grepping task/service definitions in our git repositories for example.
We can make the ECR’s vulns reports more actionable if it’s possible to lookup such vulnerable ECS tasks/services from the ECR management console quickly.

**Are you currently working around this issue?**

I have not implemented yet, but if I do that, I’d keep track of all the _active_ container image names by recording start/stop ECS task events into DynamoDB table and/or Elasticsearch to lookup vulnerable tasks/services with a Lambda function which subscribes the ECR image scanning events.

**Additional context**

**Attachments**

The request covers ECS tasks, ECR image scanning, cross-account lookup, and possible ECR events, but names no repository files, tests, or implementation entry point. Start by clarifying whether the desired result belongs in the ECR console, ECR events, or both, and define the cross-account scope; done would mean an agreed, actionable design for finding services and tasks using a vulnerable image.

Written by the indexing model from the issue text.