diff --git a/avd_docs/aws/ecr/AVD-AWS-0191/docs.md b/avd_docs/aws/ecr/AVD-AWS-0191/docs.md new file mode 100644 index 000000000..d26218f5b --- /dev/null +++ b/avd_docs/aws/ecr/AVD-AWS-0191/docs.md @@ -0,0 +1,13 @@ + +Ensure ECR repository has image scans disabled. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html + + diff --git a/internal/rules/policies/cloud/policies/aws/ecr/enable_image_scans.rego b/internal/rules/policies/cloud/policies/aws/ecr/enable_image_scans.rego new file mode 100644 index 000000000..f59f5465f --- /dev/null +++ b/internal/rules/policies/cloud/policies/aws/ecr/enable_image_scans.rego @@ -0,0 +1,25 @@ +# METADATA +# title: "ECR Image Scans" +# description: "Ensure ECR repository has image scans disabled." +# scope: package +# schemas: +# - input: schema.input +# related_resources: +# - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html +# custom: +# avd_id: AVD-AWS-0191 +# provider: aws +# service: ecr +# severity: HIGH +# short_code: enable-image-scans +# recommended_action: "Repository image scans should be enabled to ensure vulnerable software can be discovered and remediated as soon as possible." +# input: +# selector: +# - type: cloud +package builtin.aws.ecr.aws0191 + +deny[res] { + repo := input.aws.ecr.repositories[_] + not repo.imagescanning.scanonpush.value + res := result.new("Image scanning is not enabled.", repo.imagescanning.scanonpush) +} diff --git a/internal/rules/policies/cloud/policies/aws/ecr/enable_image_scans_test.rego b/internal/rules/policies/cloud/policies/aws/ecr/enable_image_scans_test.rego new file mode 100644 index 000000000..e81812559 --- /dev/null +++ b/internal/rules/policies/cloud/policies/aws/ecr/enable_image_scans_test.rego @@ -0,0 +1,11 @@ +package builtin.aws.ecr.aws0191 + +test_detects_when_disabled { + r := deny with input as {"aws": {"ecr": {"repositories": [{"imagescanning": {"scanonpush": {"value": false}}}]}}} + count(r) == 1 +} + +test_when_enabled { + r := deny with input as {"aws": {"ecr": {"repositories": [{"imagescanning": {"scanonpush": {"value": true}}}]}}} + count(r) == 0 +} \ No newline at end of file