Enable encryption for ECR in the ecr stack #1200
Assignees
Labels
Comments
|
This is a great addition, thanks for opening the issue @mourya-33 |
dlpzx
pushed a commit
that referenced
this issue
May 8, 2024
### Feature or Bugfix - Bugfix ### Detail - Currently the ecr repository created do not have encryption and tag immutability enabled which is identified by checkov scans. This fix is to enable both. ### Relates [- <URL or Ticket>](#1200) ### Security Please answer the questions below briefly where applicable, or write `N/A`. Based on [OWASP 10](https://owasp.org/Top10/en/). - Does this PR introduce or modify any input fields or queries - this includes N/A - Is the input sanitized? N/A - What precautions are you taking before deserializing the data you consume? N/A - Is injection prevented by parametrizing queries? N/A - Have you ensured no `eval` or similar functions are used? N/A - Does this PR introduce any functionality or component that requires authorization? N/A - How have you ensured it respects the existing AuthN/AuthZ mechanisms? N/A - Are you logging failed auth attempts? N/A - Are you using or adding any cryptographic features? N/A - Do you use a standard proven implementations? N/A - Are the used keys controlled by the customer? Where are they stored? No. This is with default encryption - Are you introducing any new policies/roles/users? N/A - Have you used the least-privilege principle? How? N/A By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Currently, the ECR repository created as part of the ECR stack is not encrypted. This is flagged by checkov as the following failure.
CheckID : CKV_AWS_136
CheckName : Ensure that ECR repositories are encrypted using KMS
File : /cdk.out/assembly-dataall-pr-cicd-stack-dataall-ecr-stage/dataallprcicdstackdataallecrstageprecrstack3C1CC298.template.json:3-101
Resource : AWS::ECR::Repository.ECRRepositoryF3A3832E
How to Reproduce
run checkov scan on the ecr stack template to see the encryption check failures
Expected behavior
ECR repository should be encrypted and the checkov scan check should succeed.
Your project
No response
Screenshots
No response
OS
Mac
Python version
3.10
AWS data.all version
2.3
Additional context
No response
The text was updated successfully, but these errors were encountered: