inspector-sfn-ecr-quarantine-cdk: Auto-quarantine vulnerable ECR images - #3305
Open
NithinChandranR-AWS wants to merge 1 commit into
Conversation
…rable ECR images An Amazon Inspector finding on a vulnerable Amazon ECR image triggers, via Amazon EventBridge, an AWS Step Functions workflow that re-tags the image as quarantined (BatchGetImage + PutImage) and notifies via Amazon SNS. Zero AWS Lambda functions. EventBridge target has an Amazon SQS dead-letter queue; the SNS topic is encrypted with AWS KMS. Deployed and tested end-to-end in us-east-1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
An Amazon Inspector finding on a vulnerable Amazon ECR image triggers, via Amazon EventBridge, an AWS Step Functions workflow that re-tags the image as quarantined and notifies via Amazon SNS. No AWS Lambda functions.
Architecture
Amazon Inspector finding (HIGH/CRITICAL, AWS_ECR_CONTAINER_IMAGE) -> Amazon EventBridge rule -> AWS Step Functions workflow: BatchGetImage reads the image manifest by digest, PutImage writes the same manifest under a 'quarantine' tag, then Amazon SNS notifies. The EventBridge target has an Amazon SQS dead-letter queue; the SNS topic is encrypted with AWS KMS. The image re-tag is a pure Step Functions AWS SDK integration, so there are no AWS Lambda functions.
Deployed and Tested
Deployed in us-east-1 and tested end-to-end: pushed an image, drove the workflow with a HIGH-severity finding event, and confirmed the image gained the 'quarantine' tag; the execution completed with SUCCEEDED.
Checklist