ECR images should be set to IMMUTABLE to prevent code injection through image mutation.
This can be done by setting image_tag_mutability to IMMUTABLE
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Only use immutable images in ECR
1
2
3
4
5
6
7
8
9
10
11
|
Resources:
GoodExample:
Type: AWS::ECR::Repository
Properties:
EncryptionConfiguration:
EncryptionType: KMS
KmsKey: alias/ecr-key
ImageScanningConfiguration:
ScanOnPush: false
ImageTagMutability: IMMUTABLE
RepositoryName: test-repository
|
Only use immutable images in ECR
1
2
3
4
5
6
7
8
|
resource "aws_ecr_repository" "good_example" {
name = "bar"
image_tag_mutability = "IMMUTABLE"
image_scanning_configuration {
scan_on_push = true
}
}
|
Links