Inspect an image pushed to ECR before production deployment.
Detect known operating-system and package vulnerabilities.
Which feature is most appropriate?
Enable ECR enhanced scanning integrated with Amazon Inspector for continuous image vulnerability findings.
Detailed explanation
DNS reachability checks do not find package vulnerabilities.
DNS reachability checks do not find package vulnerabilities.
Enhanced scanning continuously examines image components and reports known vulnerabilities.
Enhanced scanning continuously examines image components and reports known vulnerabilities.
A tag name does not scan image contents.
A tag name does not scan image contents.
S3 versioning does not analyze container package vulnerabilities.
S3 versioning does not analyze container package vulnerabilities.
Check official documentation
Compare the following points with the official documentation.
Amazon ECR enhanced scanning with Inspectorの公式説明を確認する。
What to confirm
イメージスキャンとデプロイ実行を分けて説明できる。
Key points
- ECR enhanced scanning
- Amazon Inspector
- Container vulnerability
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Pre-deployment control
Scanning provides evidence before an image is promoted to production.
Continuous findings
New vulnerability intelligence can change findings after an image was first pushed.