rhendricksen/ecr-scan-image

•Updated almost 6 years ago

Bitbucket Pipelines Pipe to run AWS ECR vulnerability scan on Docker image

Image

2.7K

rhendricksen/ecr-scan-image repository overview

⁠Bitbucket Pipelines Pipe: ECR Scan Image

Inspired by the ecr-scan-image⁠ Github Action by Alex Jurkiewicz.
I modified the source so it would work as a Bitbucket Pipelines Pipe.

⁠YAML Definition

Add the following snippet to the script section of your bitbucket-pipelines.yml file:

- pipe: docker://rhendricksen/ecr-scan-image:1.0.0
  variables:
    REPOSITORY: '<string>'
    TAG: '<string>'
    FAIL_THRESHOLD: '<string>'

⁠Variables

Variable	Usage
REPOSITORY (*)	ECR Repository name.
TAG (*)	Image tag to scan.
FAIL_THRESHOLD	Set fail treshold. Fail if any vulnerabilities equal to or over this severity level are detected. Valid values: critical, high, medium, low, informational. Default value is high.
IGNORE_LIST	List of CVE IDs to ignore. ⚠️ Note: The ignore_list can either be a multi-line string (like the example below) or a list (separated using commas or spaces) containing CVE IDs to be ignored.
AWS_ACCESS_KEY_ID	Required in combination with AWS_SECRET_ACCESS_KEY for access to the ECR Repository. Default value is $AWS_ACCESS_KEY_ID.
AWS_SECRET_ACCESS_KEY	Required in combination with AWS_ACCESS_KEY_ID for access to the ECR Repository. Default value is $AWS_SECRET_ACCESS_KEY.
AWS_REGION	Set AWS Region, e.g. 'eu-west-1'. Default value is $AWS_DEFAULT_REGION.

(*) = required variable.

⁠Required ECR permissions

To use this GitHub action in your workflow, your ECR role/user will need to have the following permissions:

ecr:DescribeImageScanFindings
ecr:StartImageScan (unless scan on push⁠ is enabled)

⁠Examples

Basic example:

script:
  - pipe: docker://rhendricksen/ecr-scan-image:1.0.0
    variables:
      REPOSITORY: 'myorg/myapp'
      TAG: 'latest'
      FAIL_THRESHOLD: 'critical'
      IGNORE_LIST: |
        CVE-2014-7654321
        CVE-2014-456132
      AWS_ACCESS_KEY_ID: 'xxx'
      AWS_SECRET_ACCESS_KEY: 'xxx'
      AWS_REGION: 'eu-west-1'

⁠Development

You can test the pipe locally by first building the Docker image:

docker build -t ecr-scan-image:dev .

Then run as follows:

docker run -t \
  -e REPOSITORY=myorg/myapp \
  -e TAG=test-tag \
  -e FAIL_THRESHOLD=critical \
  -e AWS_ACCESS_KEY_ID=xxx \
  -e AWS_SECRET_ACCESS_KEY=xxx \
  -e AWS_REGION=xxx \
  ecr-scan-image:dev

Or when using local AWS profiles:

docker run -t \
  -v ~/.aws:/root/.aws \
  -e REPOSITORY=myorg/myapp \
  -e TAG=test-tag \
  -e FAIL_THRESHOLD=critical \
  -e AWS_SDK_LOAD_CONFIG=1 \
  -e AWS_PROFILE=xxx \
  -e AWS_REGION=xxx \
  ecr-scan-image:dev

Tag summary

Recent tags

Content type

Image

Digest

Size

35.5 MB

Last updated

almost 6 years ago

docker pull rhendricksen/ecr-scan-image