ECR registry scans images on push in all repositories

Check ID: ecr_registry_scan_images_on_push_enabled
Provider: AWS
Service: ecr
Severity: MEDIUM
Categories: container-security
Resource type: Other

What this check verifies

Amazon ECR registries with repositories are evaluated for image scanning configured as scan on push at the registry level, with scan rules that cover all repositories (no restrictive filters), for either basic or enhanced scanning.

Risk

Absent or filtered scan on push lets vulnerable images be pushed and deployed without timely detection, enabling exploitation of known CVEs (RCE, privilege escalation), supply chain compromise, and lateral movement - threatening workload integrity and data confidentiality.

Recommendation

Enable registry-wide scan on push and ensure rules apply to all repositories (no filters). Prefer enhanced scanning for broader coverage, and pair with continuous scans when available. Integrate findings into CI/CD gates and alerts to enforce defense in depth and block promotion of risky images.

Remediation

CLI
Terraform
Dashboard steps

aws ecr put-registry-scanning-configuration --rules 'scanFrequency=SCAN_ON_PUSH,repositoryFilters=[{filter=string,filterType=WILDCARD}]'

resource "aws_ecr_registry_scanning_configuration" "<example_resource_name>" {
  scan_type = "ENHANCED"

  rule {
    scan_frequency = "SCAN_ON_PUSH"  # Ensures scan on push
    repository_filter {
      filter      = "*"               # Applies to all repositories
      filter_type = "WILDCARD"
    }
  }
}

References

https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecr_registry_scan_images_on_push_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Transit Gateway does not auto-accept VPC attachments ECR repository has a lifecycle policy configured

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires