Back to Checks
aws

ECR registry has enhanced scanning enabled

ecr_registry_enhanced_scanning_enabled
Service: ecrSeverity: medium
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Other

Amazon ECR registries with repositories are evaluated for enhanced scanning, the Amazon Inspector-powered scan type that covers operating system and programming language packages and can rescan images continuously as new CVEs are published. A registry left on basic scanning is reported as failing.

Prowler logoProwlerprowler-provider-aws

Risk

Basic scanning matches only OS packages against a static CVE list, so application dependencies (npm, PyPI, Maven, Go, .NET) are never assessed. It rescans only on push or on an explicit StartImageScan, at most once per 24 hours, so a CVE published since the last scan stays invisible until someone acts. Vulnerable images keep being pulled, enabling RCE and supply chain compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecr_registry_enhanced_scanning_enabled

Recommendation

Set the registry scan type to enhanced scanning, which delegates scanning to Amazon Inspector and adds programming language package coverage plus continuous rescanning on top of the operating system coverage that basic scanning provides. Feed the resulting findings into CI/CD gates so vulnerable images are not promoted.

Remediation

CLI

aws ecr put-registry-scanning-configuration --scan-type ENHANCED --rules 'scanFrequency=CONTINUOUS_SCAN,repositoryFilters=[{filter=*,filterType=WILDCARD}]'

Terraform

resource "aws_ecr_registry_scanning_configuration" "<example_resource_name>" {
  scan_type = "ENHANCED"

  rule {
    scan_frequency = "CONTINUOUS_SCAN"
    repository_filter {
      filter      = "*"
      filter_type = "WILDCARD"
    }
  }
}

NativeIaC

Resources:
  RegistryScanningConfiguration:
    Type: AWS::ECR::RegistryScanningConfiguration
    Properties:
      ScanType: ENHANCED  # Critical: BASIC limits the registry to operating-system coverage
      Rules:
        - ScanFrequency: CONTINUOUS_SCAN
          RepositoryFilters:
            - Filter: "*"  # Critical: coverage comes from the filters, so * is what reaches every repository
              FilterType: WILDCARD

Other

1Open the AWS Management Console and go to Amazon ECR
2In the left menu, click Private registry, then Scanning
3Click Edit
4Set Scanning type to Enhanced scanning
5Under Enhanced scanning, add or keep a repository filter matching every repository that must be scanned. Coverage comes from the filters, not from the frequency: a filter of * covers the whole registry, and any repository no filter matches is left unscanned
6Set the scan frequency for those filters, either Continuous scanning or Scan on push
7Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecr.ecr_client import ecr_client


class ecr_registry_enhanced_scanning_enabled(Check):
    """Verify that in-use ECR registries have enhanced scanning enabled.

    Enhanced scanning (Amazon Inspector) covers operating system and programming
    language packages with continuous rescanning as new CVEs are published, while
    basic scanning only covers operating system packages at push time against a
    static CVE list. Only registries holding at least one repository are checked.
    - PASS: the registry scan type is ENHANCED.
    - FAIL: the registry is on another scan type.
    - MANUAL: the registry scanning configuration could not be retrieved, so the
      scan type is unknown.
    """

    def execute(self) -> list[Check_Report_AWS]:
        """Execute the check logic.

        Returns:
            A list of reports containing the result of the check.
        """
        findings = []
        for registry in ecr_client.registries.values():
            # We want to check the registry if it is in use, hence there are repositories
            if len(registry.repositories) != 0:
                report = Check_Report_AWS(metadata=self.metadata(), resource=registry)
                if registry.scan_type is None:
                    report.status = "MANUAL"
                    report.status_extended = f"ECR registry {registry.id} scanning configuration could not be retrieved, check manually if enhanced scanning is enabled."
                elif registry.scan_type == "ENHANCED":
                    report.status = "PASS"
                    report.status_extended = (
                        f"ECR registry {registry.id} has enhanced scanning enabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = f"ECR registry {registry.id} has {registry.scan_type} scanning enabled instead of enhanced scanning."

                findings.append(report)

        return findings

References