ECR images should be set to IMMUTABLE to prevent code injection through image mutation.
This can be done by setting image_tag_mutability to IMMUTABLE
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Only use immutable images in ECR
1
2
3
4
5
6
|
Resources:
GoodExample:
Type: AWS::ECR::Repository
Properties:
ImageTagMutability: IMMUTABLE
RepositoryName: test-repository
|
Only use immutable images in ECR
1
2
3
4
|
resource "aws_ecr_repository" "good_example" {
name = "bar"
image_tag_mutability = "IMMUTABLE"
}
|
Links