ECR registry has no automatic image scanning configured
- Severity
- Medium
- Service
- ECR
- Check ID
- ECR_REGISTRY_SCAN_DISABLED
What this check finds
The ECR registry scanning configuration has no rules, so container images are not scanned for known vulnerabilities on push or continuously. Vulnerable OS packages and libraries can be pushed and deployed without any CVE detection.
Passing looks like: ECR registry image scanning enabled.
How to fix it
Configure registry scanning with a scan-on-push (or continuous, with Enhanced scanning) rule covering all repositories.
AWS CLI
aws ecr put-registry-scanning-configuration --scan-type ENHANCED --rules '[{"scanFrequency":"SCAN_ON_PUSH","repositoryFilters":[{"filter":"*","filterType":"WILDCARD"}]}]'
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
ECR → Private registry → Scanning configuration.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs