Back to Checks
aws

ECR repository latest image is scanned with no vulnerabilities at or above the configured minimum severity

ecr_repositories_scan_vulnerabilities_in_latest_image
Service: ecrSeverity: medium
OfficialBuilt-inVerified
Categories:container-security
Resource Type:AwsEcrRepository

Amazon ECR repositories are assessed on the most recent pushed image to confirm a vulnerability scan exists, completed successfully, and that no results meet or exceed the configured minimum severity (e.g., CRITICAL, HIGH, MEDIUM).

Prowler logoProwlerprowler-provider-aws

Risk

Unscanned or high-severity findings in container images expose workloads to exploitation of known CVEs.

Attackers can gain code execution, exfiltrate data, alter services, or disrupt operations, enabling lateral movement and supply-chain compromise-impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecr_repositories_scan_vulnerabilities_in_latest_image

Recommendation

Enable continuous scanning for repositories and enforce deployment gates at your policy threshold (e.g., MEDIUM+).

Rebuild images with patched components and updated bases, keep images minimal, and apply least privilege. Use image signing and CI/CD checks so only scanned, compliant images can run.

Remediation

Terraform

# Enable scan on push so the latest image is automatically scanned
resource "aws_ecr_repository" "<example_resource_name>" {
  name = "<example_resource_name>"

  image_scanning_configuration {
    scan_on_push = true  # CRITICAL: ensures each pushed image is scanned so the latest has scan results
  }
}

NativeIaC

# Enable scan on push so the latest image is automatically scanned
Resources:
  EcrRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: <example_resource_name>
      ImageScanningConfiguration:
        ScanOnPush: true  # CRITICAL: ensures each pushed image is scanned so the latest has scan results

Other

1In the AWS Console, go to ECR > Repositories > <example_resource_name>
2Click Edit and enable Scan on push, then Save
3Rebuild the container image to remove vulnerabilities and push a new tag to the repository
4Open the image details and click Scan image (if not auto-scanned)
5Confirm Findings show 0 vulnerabilities at or above the required severity

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecr.ecr_client import ecr_client


class ecr_repositories_scan_vulnerabilities_in_latest_image(Check):
    def execute(self):
        findings = []

        # Get minimun severity to report
        minimum_severity = ecr_client.audit_config.get(
            "ecr_repository_vulnerability_minimum_severity", "MEDIUM"
        )

        for registry in ecr_client.registries.values():
            for repository in registry.repositories:
                # First check if the repository has images
                if len(repository.images_details) > 0:
                    # We only want to check the latest image pushed that is scannable
                    image = repository.images_details[-1]
                    report = Check_Report_AWS(
                        metadata=self.metadata(), resource=repository
                    )
                    report.status = "PASS"
                    status_extended_prefix = f"ECR repository '{repository.name}' has scanned the {image.type} container image with digest '{image.latest_digest}' and tag '{image.latest_tag}' "
                    report.status_extended = (
                        status_extended_prefix + "without findings."
                    )
                    if not image.scan_findings_status:
                        report.status = "FAIL"
                        report.status_extended = (
                            status_extended_prefix + "without a scan."
                        )
                    elif image.scan_findings_status == "FAILED":
                        report.status = "FAIL"
                        report.status_extended = (
                            status_extended_prefix + "with scan status FAILED."
                        )
                    elif (
                        image.scan_findings_status != "FAILED"
                        and image.scan_findings_severity_count
                    ):
                        if (
                            minimum_severity == "CRITICAL"
                            and image.scan_findings_severity_count.critical
                        ):
                            report.status = "FAIL"
                            report.status_extended = (
                                status_extended_prefix
                                + f"with findings: CRITICAL->{image.scan_findings_severity_count.critical}."
                            )
                        elif minimum_severity == "HIGH" and (
                            image.scan_findings_severity_count.critical
                            or image.scan_findings_severity_count.high
                        ):
                            report.status = "FAIL"
                            report.status_extended = (
                                status_extended_prefix
                                + f"with findings: CRITICAL->{image.scan_findings_severity_count.critical}, HIGH->{image.scan_findings_severity_count.high}."
                            )
                        elif minimum_severity == "MEDIUM" and (
                            image.scan_findings_severity_count.critical
                            or image.scan_findings_severity_count.high
                            or image.scan_findings_severity_count.medium
                        ):
                            report.status = "FAIL"
                            report.status_extended = (
                                status_extended_prefix
                                + f"with findings: CRITICAL->{image.scan_findings_severity_count.critical}, HIGH->{image.scan_findings_severity_count.high}, MEDIUM->{image.scan_findings_severity_count.medium}."
                            )

                    findings.append(report)

        return findings

References