AWS Security Hub · ECR
ECR.1: Container images are not scanned on push
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub ECR.1 check?
ECR.1 checks that a private ECR repository has image scanning configured. It reports FAILED only when the repository is configured for neither scan-on-push (basic scanning) nor continuous scanning (enhanced scanning via Amazon Inspector). A repository with either option enabled passes, so scan-on-push being off does not by itself fail the control if continuous scanning covers the repository.
Why does ECR.1 matter?
A repository pushing images blind means known-vulnerable packages ship to production with no signal. Scanning surfaces CVEs in the layers you deploy, and pairing it with tag immutability ensures a clean image cannot be quietly swapped for a vulnerable one after it has been scanned.
How do I fix ECR.1?
- Inventory repositories and check their scanning configuration.
- Enable scan-on-push at the repository level, or set enhanced scanning at the registry level for continuous rescanning via Amazon Inspector.
- Wire the findings into Security Hub so they sit alongside the rest of your posture.
- Pair scanning with tag immutability so scanned images cannot be replaced.
Remediation script · bash
# Enable the GuardDuty base detector in every Region (run from the delegated admin account).
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
existing=$(aws guardduty list-detectors --region "$region" --query 'DetectorIds[0]' --output text)
if [ "$existing" = "None" ]; then
aws guardduty create-detector --enable \
--finding-publishing-frequency FIFTEEN_MINUTES --region "$region"
echo "$region: GuardDuty detector created"
fi
done
# Turn on Inspector EC2/ECR/Lambda scanning for this account and Region.
aws inspector2 enable --resource-types EC2 ECR LAMBDA
# Enable Macie (free bucket inventory clears Macie.1; discovery jobs are scoped separately by risk).
aws macie2 enable-macie --status ENABLED --finding-publishing-frequency FIFTEEN_MINUTESFull walkthrough (console steps, edge cases and verification) in the lesson Enable threat detection and vulnerability scanning.
Is ECR.1 a false positive?
The control only recognises Amazon ECR's own scanning: basic scan-on-push or Inspector enhanced scanning configured at the registry. A repository deliberately scanned by a third-party tool (Trivy or Snyk in CI, an external registry scanner) will still report FAILED because no native ECR scan configuration is set, even though those images are being assessed for vulnerabilities. Likewise, registry-level enhanced scanning uses repository filters, so a repository excluded by your filter pattern fails even when continuous scanning is on for the registry. If the scanning is genuinely happening elsewhere, suppress the finding with a workflow status of SUPPRESSED in Security Hub and record where the equivalent scan runs, rather than turning on a redundant native scan.