Back to Checks
aws

[DEPRECATED] ECR repository has image scanning on push enabled

ecr_repositories_scan_images_on_push_enabled
Service: ecrSeverity: medium
OfficialBuilt-inVerified
Categories:container-security
Resource Type:AwsEcrRepository

[DEPRECATED] Amazon ECR repositories are evaluated for image scanning on push; when configured, new image uploads automatically trigger a vulnerability scan (scan_on_push).

Prowler logoProwlerprowler-provider-aws

Risk

Without scan on push, images with known CVEs can enter registries and reach runtime unnoticed, undermining integrity and confidentiality through exploitable packages. Attackers may achieve code execution and lateral movement. Delayed detection increases operational risk and extends remediation timelines.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecr_repositories_scan_images_on_push_enabled

Recommendation

Enable image scanning on push (scan_on_push) for all repositories and use findings as promotion gates. Prefer continuous/enhanced scanning for defense in depth, set severity thresholds, and block or quarantine noncompliant images. Integrate results with CI/CD and adopt shift-left vulnerability management.

Remediation

CLI

aws ecr put-image-scanning-configuration --repository-name <repo_name> --image-scanning-configuration scanOnPush=true

Terraform

resource "aws_ecr_repository" "<example_resource_name>" {
  name = "<example_resource_name>"

  image_scanning_configuration {
    scan_on_push = true # Critical: enables scanning on image push
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ECR::Repository
    Properties:
      ImageScanningConfiguration:
        ScanOnPush: true  # Critical: enables image scanning on push for this repository

Other

1Open the AWS Console and go to Amazon ECR
2Click Repositories and select the target repository
3Click Edit
4Enable the Scan on push toggle
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecr.ecr_client import ecr_client


class ecr_repositories_scan_images_on_push_enabled(Check):
    def execute(self):
        findings = []
        for registry in ecr_client.registries.values():
            for repository in registry.repositories:
                report = Check_Report_AWS(metadata=self.metadata(), resource=repository)
                report.status = "PASS"
                report.status_extended = (
                    f"ECR repository {repository.name} has scan on push enabled."
                )
                if not repository.scan_on_push:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"ECR repository {repository.name} has scan on push disabled."
                    )

                findings.append(report)

        return findings

References