Check ID: ecr_repositories_scan_vulnerabilities_in_latest_image
Provider: AWS
Service: ecr
Severity: MEDIUM
Categories: container-security
Resource type: AwsEcrRepository

​
What this check verifies

Amazon ECR repositories are assessed on the most recent pushed image to confirm a vulnerability scan exists, completed successfully, and that no results meet or exceed the configured minimum severity (e.g., CRITICAL, HIGH, MEDIUM).

​
Risk

Unscanned or high-severity findings in container images expose workloads to exploitation of known CVEs. Attackers can gain code execution, exfiltrate data, alter services, or disrupt operations, enabling lateral movement and supply-chain compromise-impacting confidentiality, integrity, and availability.

​
Recommendation

Enable continuous scanning for repositories and enforce deployment gates at your policy threshold (e.g., MEDIUM+). Rebuild images with patched components and updated bases, keep images minimal, and apply least privilege. Use image signing and CI/CD checks so only scanned, compliant images can run.

​
Remediation

# Enable scan on push so the latest image is automatically scanned
resource "aws_ecr_repository" "<example_resource_name>" {
  name = "<example_resource_name>"

  image_scanning_configuration {
    scan_on_push = true  # CRITICAL: ensures each pushed image is scanned so the latest has scan results
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecr_repositories_scan_vulnerabilities_in_latest_image. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks