ECR private repositories should have image scanning configured

How to fix it

• Overwrites existing settings: The CLI and Terraform routes replace the registry's whole scanning configuration with Basic and one rule, so keep any existing rules, and Enhanced if it is on.

In the console

Elastic Container Registry → Private registry → Features & Settings → Scanning → Configure

Scan type

Basic scanning or Enhanced scanning (either passes)

Scan on push filters

A filter matching this repository, such as * for every repository

With the AWS CLI

aws ecr put-registry-scanning-configuration --scan-type BASIC --rules '[{"scanFrequency":"SCAN_ON_PUSH","repositoryFilters":[{"filter":"*","filterType":"WILDCARD"}]}]' --region <region>

With Terraform

resource "aws_ecr_registry_scanning_configuration" "this" {
  scan_type = "BASIC"

  rule {
    scan_frequency = "SCAN_ON_PUSH"

    repository_filter {
      filter      = "*"
      filter_type = "WILDCARD"
    }
  }
}