All checks
Low
ECR repositories should be encrypted with customer managed AWS KMS keys
Checks that the ECR repository is encrypted at rest with a customer managed KMS key. The default, AES256, is already encrypted but uses no KMS key, and the AWS managed aws/ecr key has a policy you cannot edit; only your own key gives you a key policy you write and the ability to disable the key.
- service
- ECR
- severity
- Low
- scope
- evaluated in every region
How to fix it
- Replaces the resource: A repository's encryption is fixed at creation: create a new repository with your KMS key, push the images and copy its policies to it, repoint pulls, then delete this one.
In the console
Elastic Container Registry → Private registry → Repositories → Create repository
- Encryption configuration
- AWS KMS
- AWS KMS encryption setting
- Customer managed key, your own KMS key from this Region rather than the default aws/ecr key
With the AWS CLI
aws ecr create-repository --repository-name <name> --encryption-configuration encryptionType=KMS,kmsKey=<kms-key-arn>With Terraform
resource "aws_ecr_repository" "this" {
name = var.repository_name
encryption_configuration {
encryption_type = "KMS"
kms_key = var.kms_key_arn
}
}See which of your accounts this check is failing on.
Book a live scan