Repository navigation
Fix aws_ecr_image_scanning for enhanced scanning, with correct counts - #324
Open
21tmccauley wants to merge 1 commit into
Open
21tmccauley wants to merge 1 commit into
21tmccauley wants to merge 1 commit into
Conversation
Brings in Lucid's aws_ecr_image_scanning 0.3.0 changes from #300 (reads scan results regardless of scan_on_push, resolves effective scan frequency, all six severities, null instead of a false zero), plus a fix for its severity counts. With enhanced (Inspector) scanning, ECR's findingSeverityCounts covers only the findings on the returned page. #300 requested one finding per page, so an image with 456 critical and 3,589 high reported 0 critical, 0 high, 1 medium. The fetcher now reads every page and counts enhancedFindings itself; BASIC scans keep AWS's total. Verified live against Inspector (all six severities match on a 10,357-finding image). Also documents that enhanced scanning needs inspector2:ListCoverage and inspector2:ListFindings (verified with a role holding exactly the listed permissions), and raises the runtime timeout to 3600s since a 10k-finding image takes about 90s to read. Co-authored-by: Rocky Olsen <rolsen@lucidchart.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The third piece of #300 (contributed by Lucid, co-authored by Rocky Olsen). The other two fetchers merged in #323. This carries Rocky's
aws_ecr_image_scanning0.3.0 changes plus a fix for a severity-count bug found in live testing.From #300
scan_on_push, including enhanced continuous and completed manual scans. Before this, enhanced registries reportedlatest_image_scan: null.nullinstead of a false 0 when counts are unknown.ecr:BatchGetRepositoryScanningConfiguration(upgrade step in the CHANGELOG).The fix
With enhanced (Inspector) scanning, ECR's
findingSeverityCountscovers only the findings on the returned page, not the whole image. #300 requested one finding per page (--max-results 1 --no-paginate), so the counts covered a single finding. On a live image with 10,357 findings it reported:The fetcher now reads every page and counts
enhancedFindingsitself. BASIC scans keep AWS's total. The raw response goes to a temp file and is reduced to the summary straight away.inspector2:ListCoverageandinspector2:ListFindingsonDescribeImageScanFindings. I verified this with a role holding exactly the documented permissions (denied without them, correct counts with them). Both are now in the README and CHANGELOG.Tests
framework/.mainvs this branch on an enhanced registry withscan_on_push=false(mainreports null, this branch reports the scan), plus the count comparison above.Closes #300 together with #323.
🤖 Generated with Claude Code