Amazon ECR
4 min
you can scan amazon ecr using our docker integration the recommended setup is to run the enterprise scanner on an aws host with an attached iam role for ecr access keeping docker login and the scan on the same host is the simplest, most reliable configuration important no auto enumeration of images every image uri must be explicitly listed ecr tokens expire approximately every 12 hours consider creating a cron for docker login for recurring scans to refresh the authentication token walkthrough 1\ create the scanner in the dashboard and download the config yml to your host 2\ create an aws iam user group with the pre defined policy amazonec2containerregistryreadonly 3\ add a user to the aws iam user group 4\ authenticate to ecr aws ecr's docker login always uses the literal username aws, which is used below confirm you have the correct docker container repo address (e g 123456789012 dkr ecr us east 1 amazonaws com/your repo) example aws ecr get login password region us east 1 | docker login username aws password stdin 123456789012 dkr ecr us east 1 amazonaws com/your repo note this stores the credential in / docker/config json of the user who ran it (e g /root/ docker/config json or /home/ec2 user/ docker/config json), base64 encoded 5\ add the docker source to config yml sources \ connection "@type" type googleapis com/sources docker dockerkeychain true images 123456789012 dkr ecr us east 1 amazonaws com/my app\ latest name docker scanperiod 12 type source type docker verify true no username/password in the yaml dockerkeychain true reads the credential from step 3 the full registry hostname in each image uri tells the scanner which ecr registry to pull from 5\ run the scan /scanner scan config=config yaml validate first if needed /scanner validate config=config yaml debug important points self hosted scanner only ecr scanning cannot be performed on the hosted scanner run as the same user the scanner must be run by the same user that executed docker login because it reads the keychain from that specific user's home directory no auto enumeration every image uri must be explicitly listed only linux/amd64 images are scanned images for arm64 or multi arch architectures are skipped ecr token expiration tokens expire approximately every 12 hours; docker login should be scheduled via cron for recurring scans full egress recommended partial allowlists can degrade results as the scanner verifies secrets against over 800 endpoints
