Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ECR - Scan on push at the repository level deprecated #1905

Open
fmmorais opened this issue Feb 9, 2024 · 0 comments
Open

ECR - Scan on push at the repository level deprecated #1905

fmmorais opened this issue Feb 9, 2024 · 0 comments

Comments

@fmmorais
Copy link

fmmorais commented Feb 9, 2024

The plugin Amazon ECR Scan on Push is using ECR:describe-repositories.imageScanningConfiguration.scanOnPush to determine if Scan on Push is enabled in a repository. Nevertheless, repository level scan on push setting was deprecated in favor of Registry level scan on push filters.

'imageScanningConfiguration.scanOnPush' shouldn`t be used anymore to test if scan on push is enabled. Although at the repository level scanOnPush = False, at the registry level scanning might enabled and including repositories due to the values in the filters.

A new logic should be built based on the scan filters at the registry level.

'batch-get-repository-scanning-configuration.appliedScanFilters' would return the filters applied. One possible test is to verify if a wildcard "*" is used, which would include all repositories in the registry. Another logic would be applying the filter to the repository names to determine the ones excluded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant