Skip to content

AWS CDK module to easily get alerts from ECR image scan findings.

License

Notifications You must be signed in to change notification settings

markusl/cdk-ecr-image-scan-handler

Repository files navigation

NPM version Release

cdk-ecr-image-scan-handler

Amazon ECR image scanning helps in identifying software vulnerabilities in your container images.

With this CDK construct you can get automated notifications from ECR images that contain security findings when the AWS ECR image scan finishes.

Usage

In your ECR repository setup, create a SNS topic:

  const onImageScanCompletedTopic = new sns.Topic(stack, 'RepositoryScanTopic', {
    topicName: 'ecr-repository-scan-completed-topic',
    displayName: 'Notifications about ECR Repository scans',
  });

Hook each ECR repository to report image scan results to the previously created topic:

  const ecrRepository = new ecr.Repository(stack, 'DemoEcrRepository', {
    repositoryName: name,
    imageScanOnPush: true,
  });
  ecrRepository.onImageScanCompleted('DemoScanCompleted', {
    target: new targets.SnsTopic(onImageScanCompletedTopic),
  });

Microsoft Teams reporting for ECR Image scan

To get notifications using Microsoft Teams Webhook, set up the handler for the previously created topic:

import { EcrImageScanTeamsWebhookHandler } from 'cdk-ecr-image-scan-handler';

const mockApp = new App();
const stack = new Stack(mockApp, 'app-stack');

new EcrImageScanTeamsWebhookHandler(stack, 'ecr-scan-result-handler', {
  webhookUrl: 'https://outlook.office.com/webhook/xxxxx',
  notificationTopicArn: 'arn:aws:sns:eu-central-1:112233445566:ecr-repository-scan-completed-topic',
});

Email results for ECR Image scan

To get reports via email, set up the handler for the previously created topic:

import { EcrImageScanResultHandler } from 'cdk-ecr-image-scan-handler';

const mockApp = new App();
const stack = new Stack(mockApp, 'app-stack');

new EcrImageScanResultHandler(stack, 'ecr-scan-result-handler', {
  fromAddress: 'from@address.com', // Use SES for validating the addresses
  toAddress: 'to@address.com',
  notificationTopicArn: 'arn:aws:sns:eu-central-1:112233445566:ecr-repository-scan-completed-topic',
});

About

AWS CDK module to easily get alerts from ECR image scan findings.

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Contributors 4

  •  
  •  
  •  
  •