Log Container Image Scan from Amazon ECR in CloudWatch

Container security is a crucial aspect of any cloud-native application. Amazon Elastic Container Registry (ECR) provides a secure and scalable solution for storing, managing, and deploying container images. With the increasing importance of security, it is essential to scan container images for vulnerabilities and ensure they meet compliance standards. Amazon ECR integrates with AWS CloudWatch, allowing you to log container image scan findings and take necessary actions. In this blog post, we will explore how to log container image scan results from Amazon ECR in CloudWatch. Let’s dive in!

I. Enabling Container Image Scanning in Amazon ECR

Before logging the scan findings, you need to enable container image scanning in Amazon ECR. Follow these steps:

1. Open the Amazon ECR console and select the repository containing the images you want to scan.
2. Click on the “Lifecycle policy” tab and create or update the repository’s lifecycle policy to include the scan-on-push rule. This rule automatically triggers a scan when pushing new images to the repository.
3. Save the lifecycle policy changes.

With container image scanning enabled, each time you push a new image to the repository, Amazon ECR automatically triggers a scan to identify vulnerabilities and provide insights into the image’s security posture.

II. Setting up CloudWatch Logs for Image Scan Findings

To log container image scan findings, you can configure CloudWatch Logs to capture the scan results. Follow these steps:

1. Open the CloudWatch console and navigate to “Log groups”.
2. Click on the “Create log group” button to create a new log group.
3. Provide a name for the log group, such as “ECR-Image-Scan-Findings”, and click on “Create log group”.

III. Creating an ECR Lifecycle Policy to Trigger Events

To capture the image scan findings in CloudWatch Logs, you need to create an Amazon EventBridge rule that triggers when a scan completes. Follow these steps:

1. Open the Amazon EventBridge console and navigate to “Rules”.
2. Click on the “Create rule” button to create a new rule.
3. Configure the rule as follows:
   • Event Pattern: Select “Event pattern” and choose “Custom pattern”.
   • Event matching pattern: Use the following pattern to match ECR image scan events:

{
  "source": ["aws.ecr"],
  "detail-type": ["ECR Image Scan"],
  "detail": {
    "finding-severity-counts": {
      "CRITICAL": [">", 0],
      "HIGH": [">", 0],
      "MEDIUM": [">", 0],
      "LOW": [">", 0],
      "INFORMATIONAL": [">", 0],
      "UNDEFINED": [">", 0]
    }
  }
}

This pattern filters events based on the severity counts of the findings.

4. Select the target as “CloudWatch Logs” and choose the log group you created earlier.
5. Configure other optional settings as per your requirements and click on “Create”.

IV. Viewing Container Image Scan Findings in CloudWatch Logs

With the CloudWatch Logs and EventBridge rule set up, you can now view the container image scan findings in CloudWatch Logs. Follow these steps:

1. Open the CloudWatch console and navigate to “Log groups”.
2. Select the log group you created for image scan findings.
3. In the log group, you will see logs generated for each image scan. Each log entry contains information about the scan findings, such as vulnerability details and severity.

V. Taking Actions Based on Scan Findings

Once the container image scan findings are logged in CloudWatch, you can leverage the power of CloudWatch and other AWS services to take automated actions based on the severity of the findings. For example, you can configure CloudWatch Alarms to trigger notifications or trigger AWS Lambda functions to perform automated remediation actions.

Conclusion

Logging container image scan findings from Amazon ECR in CloudWatch provides valuable insights into the security posture of your container images. By enabling container image scanning in Amazon ECR, setting up CloudWatch Logs, and configuring an EventBridge rule, you can automatically log scan findings and take necessary actions based on the severity of the vulnerabilities. This integration enhances the security and compliance of your containerized applications. Start leveraging the power of Amazon ECR and CloudWatch to ensure the safety and integrity of your container images. Happy scanning!