added policy to check immutable tags for ecr

avd_docs/aws/ecr/AVD-AWS-0192/docs.md

@@ -0,0 +1,13 @@
+
+Ensures ECR repository image tags cannot be overwritten
+
+### Impact
+<!-- Add Impact here -->
+
+<!-- DO NOT CHANGE -->
+{{ remediationActions }}
+
+### Links
+- https://sysdig.com/blog/toctou-tag-mutability/
+
+

avd_docs/kubernetes/general/AVD-KSV-0108/docs.md

@@ -4,6 +4,7 @@ Services with external IP addresses allows direct access from the internet and m
 ### Impact
 Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
 https://www.cvedetails.com/cve/CVE-2020-8554/
+
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}
 

internal/rules/policies/cloud/policies/aws/ecr/enforce_immutable_repository.rego

@@ -0,0 +1,25 @@
+# METADATA
+# title: "ECR Repository Tag Immutability"
+# description: "Ensures ECR repository image tags cannot be overwritten"
+# scope: package
+# schemas:
+# - input: schema.input
+# related_resources:
+# - https://sysdig.com/blog/toctou-tag-mutability/
+# custom:
+#   avd_id: AVD-AWS-0192
+#   provider: aws
+#   service: ecr
+#   severity: HIGH
+#   short_code: enforce-immutable-repository
+#   recommended_action: "Update ECR registry configurations to ensure image tag mutability is set to immutable."
+#   input:
+#     selector:
+#     - type: cloud
+package builtin.aws.ecr.aws0192
+
+deny[res] {
+	repo := input.aws.ecr.repositories[_]
+	not repo.imagetagsimmutable.value
+	res := result.new("Repository tags are mutable.", repo.imagetagsimmutable)
+}

internal/rules/policies/cloud/policies/aws/ecr/enforce_immutable_repository_test.rego

@@ -0,0 +1,11 @@
+package builtin.aws.ecr.aws0192
+
+test_detects_when_mutable {
+	r := deny with input as {"aws": {"ecr": {"repositories": [{"imagetagsimmutable": {"value": false}}]}}}
+	count(r) == 1
+}
+
+test_when_immutable {
+	r := deny with input as {"aws": {"ecr": {"repositories": [{"imagetagsimmutable": {"value": true}}]}}}
+	count(r) == 0
+}