ecr_repositories_scan_vulnerabilities_in_latest_image : Image without a scan

[NMuee]

Hello Prowler team,

In my AWS account, I have Inspector enabled (Enhanced scanning)
I have a few images being flagged as 'Image without a scan' and this is due to API calls for DescribeImageScanFindings are failing with an error code of “ScanNotFoundException” for this ECR registry, as Amazon Inspector only recognizes images pushed to Amazon ECR in the last 30 days. Older images will have the SCAN_ELIGIBILITY_EXPIRED scan status.

For such case, from your advise, do you think this should still be flagged as FAILED finding?

Thank you

[MrCloudSec]

Hi @NMuee, in which check are you getting this finding?

[MrCloudSec]

Sorry I've just shown it was the ecr_repositories_scan_vulnerabilities_in_latest_image. This check is based on ECR Calls so it has nothing to do with Inspector.
Which is the scan status of your image in the ECR console?

[NMuee]

I have checked with AWS Support, with Enhanced Scanning enabled (Inspector enabled), image that are older than 30 days are not eligible for scan, as the screenshot shown above.

For cases like this when I have repo that yet to update for > 30days, prowler flagged them FAILED as 'Image without a scan'

[MrCloudSec]

I see... you are right! What does it say in "Scan Status" in the ECS Repository console (like the screenshot I put)?

[NMuee]

There is no 'Scan Status' option

[NMuee]

Hi Prowler team,
I realise this finding is looking particularly with status "PASSED" or "FAILED" from the ecr image response.

However, for cases where inspector are turned on, which mean scan will be performed through enhanced scanning.
status is "ACTIVE"

And in the json returned, there is no 'Findings' key value, but 'Enhanced Findings' returned as a key.

For such case, can prowler team enhanced this particular findings to also cater for ECR that are on inspector? Thank you.

[NMuee]

Hi Prowler team,
I realise this finding is looking particularly with status "PASSED" or "FAILED" from the ecr image response.

However, for cases where inspector are turned on, which mean scan will be performed through enhanced scanning.
status is "ACTIVE"

And in the json returned, there is no 'Findings' key value, but 'Enhanced Findings' returned as a key.

For such case, can prowler team enhanced this particular findings to also cater for ECR that are on inspector? Thank you