All checks
High
Amazon Inspector ECR scanning should be enabled
Checks that Amazon Inspector ECR scanning is enabled in each Region where the account has ECR repositories, so container images are scanned for operating system and programming language package vulnerabilities. In an AWS Organization, only the Inspector delegated administrator can change this for a member account.
- service
- Inspector
- severity
- High
- scope
- evaluated in every region
How to fix it
- Overwrites existing settings: Activating switches this Region's private registry from ECR Basic scanning to Enhanced scanning, and scans set up under Basic are no longer available after the switch.
In the console
Amazon Inspector → Account management → Activate → ECR scanning
- ECR scanning
- Activated for this account, in this Region
With the AWS CLI
aws inspector2 enable --resource-types ECR --region <region>With Terraform
resource "aws_inspector2_enabler" "this" {
account_ids = [data.aws_caller_identity.current.account_id]
resource_types = ["ECR"]
}See which of your accounts this check is failing on.
Book a live scan