Ensure Image Vulnerability Scanning Using Amazon ECR Or Third Party Provider

#!/usr/bin/env bash
# Purpose: Report which container images used in the cluster are stored in ECR
#          and whether their repositories have scan-on-push enabled.

set -euo pipefail

# --------- CONFIGURATION ---------
# AWS CLI profile and region used to query ECR
AWS_PROFILE="default"
AWS_REGION="us-east-1"

# ---------------------------------
echo "Collecting unique container images from all namespaces..."
IMAGES=$(
  kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{range .spec.initContainers[*]}{.image}{"\n"}{end}{end}' \
  | sort -u
)

if [ -z "$IMAGES" ]; then
  echo "No images found in the cluster."
  exit 0
fi

echo "Discovered images:"
printf '  %s\n' $IMAGES
echo

# Function: parse ECR registry, repository, and tag from an image string
parse_ecr_image() {
  local image="$1"

  # Match public or private ECR:
  # private: 123456789012.dkr.ecr.us-east-1.amazonaws.com/repo[:tag]
  # public:  public.ecr.aws/alias/repo[:tag]
  if [[ "$image" =~ ^([0-9]{12}\.dkr\.ecr\.[a-z0-9-]+\.amazonaws\.com)/(.*)$ ]]; then
    local registry="${BASH_REMATCH[1]}"
    local remainder="${BASH_REMATCH[2]}"
  elif [[ "$image" =~ ^(public\.ecr\.aws)/(.*)$ ]]; then
    local registry="${BASH_REMATCH[1]}"
    local remainder="${BASH_REMATCH[2]}"
  else
    # Not an ECR image
    return 1
  fi

  # Split remainder into repo and tag/digest
  # repo:tag or repo@sha256:...
  local repo="${remainder%%[@:]*}"
  local tag_or_digest="${remainder#"$repo"}"
  local tag=""

  if [[ "$tag_or_digest" == ":"* ]]; then
    tag="${tag_or_digest#:}"
  elif [[ "$tag_or_digest" == "@"* ]]; then
    tag="${tag_or_digest#@}"
  else
    tag="latest"
  fi

  echo "$registry" "$repo" "$tag"
  return 0
}

echo "Checking ECR scan-on-push configuration for all ECR-backed images..."
echo

# Collect unique ECR repositories referenced by the cluster
declare -A ECR_REPOS=()

while read -r img; do
  parsed=$(parse_ecr_image "$img" || true)
  if [ -n "$parsed" ]; then
    registry=$(awk '{print $1}' <<< "$parsed")
    repo=$(awk '{print $2}' <<< "$parsed")
    key="$registry/$repo"
    ECR_REPOS["$key"]=1
  fi
done <<< "$IMAGES"

if [ "${#ECR_REPOS[@]}" -eq 0 ]; then
  echo "No ECR images are currently used by this cluster."
  echo "Potential issue: Images may be coming from registries where vulnerability scanning is not configured or not centrally visible."
  exit 0
fi

echo "ECR repositories referenced by the cluster:"
for key in "${!ECR_REPOS[@]}"; do
  echo "  $key"
done
echo

# Query scan-on-push for each ECR repo
echo "Repository scan-on-push status (AWS_PROFILE=$AWS_PROFILE, AWS_REGION=$AWS_REGION):"
echo

for key in "${!ECR_REPOS[@]}"; do
  registry="${key%%/*}"
  repo="${key#"$registry/"}"

  # Private ECR repositories live in specific regions and accounts.
  # Skip public ECR (public.ecr.aws) here; scanning configuration is different.
  if [[ "$registry" == "public.ecr.aws" ]]; then
    echo "public.ecr.aws/$repo : SKIPPED (public ECR; verify scanning configuration manually)"
    continue
  fi

  # Extract account ID and region from registry
  # Example registry: 123456789012.dkr.ecr.us-east-1.amazonaws.com
  account_id="${registry%%.*}"
  reg_region="$(cut -d'.' -f4 <<< "$registry")"

  # Only check in the configured AWS_REGION to avoid cross-region confusion
  if [ "$reg_region" != "$AWS_REGION" ]; then
    echo "$registry/$repo : SKIPPED (registry region $reg_region != configured AWS_REGION $AWS_REGION; run script per region)"
    continue
  fi

  # Query ECR for scan-on-push
  set +e
  SCAN_OUTPUT=$(AWS_PROFILE="$AWS_PROFILE" AWS_REGION="$AWS_REGION" aws ecr describe-repositories \
    --repository-names "$repo" \
    --query "repositories[0].imageScanningConfiguration.scanOnPush" \
    --output text 2>&1)
  status=$?
  set -e

  if [ $status -ne 0 ]; then
    echo "$registry/$repo : ERROR querying ECR: $SCAN_OUTPUT"
    continue
  fi

  if [ "$SCAN_OUTPUT" = "True" ]; then
    echo "$registry/$repo : scanOnPush=ENABLED"
  elif [ "$SCAN_OUTPUT" = "False" ]; then
    echo "$registry/$repo : scanOnPush=DISABLED  <-- REVIEW: images from this repo are not auto-scanned on push"
  else
    echo "$registry/$repo : UNKNOWN response: $SCAN_OUTPUT"
  fi
done

echo
echo "INTERPRETATION:"
echo "- Any line ending with 'scanOnPush=DISABLED' indicates a repository used by the cluster whose images are not automatically scanned on push; this is a gap against the control."
echo "- 'SKIPPED' lines require manual review to confirm that an equivalent vulnerability scanning mechanism is enabled for those registries."