scan_ecr_image_cve
Detect critical and high CVEs in ECR image layers that basic scans miss. Classifies findings as gap, confirmed, or reverse-gap against official results.
Instructions
Deep-scan ECR image layers for critical/high CVEs missed by ECR Basic/Inspector Enhanced scanning (unmanaged binaries, distro secdb gaps). Reports gap/confirmed/reverse-gap classification against official scan results. Read-only.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | AWS region to scan (default: server region) | |
| min_severity | No | Minimum CVE severity to report (default: high) | |
| suppressions | No | False-positive suppression list; suppressed findings go to a suppressed[] section | |
| max_image_bytes | No | Skip images whose compressed layers total more than this many bytes (default: 2 GB) | |
| max_layer_bytes | No | Skip images containing a layer larger than this many compressed bytes (default: 512 MB) | |
| max_total_bytes | No | Cumulative cap on compressed layer bytes downloaded across the whole scan (default: 20 GB) | |
| max_repositories | No | Maximum number of repositories to scan; the rest are recorded in warnings (default: 50) | |
| include_confirmed | No | Include confirmed finding detail rows in the report (default: false) | |
| online_cve_lookup | No | Enable NVD API 2.0 online lookup, cached 24h (default: false) | |
| repository_filter | No | Glob filter on ECR repository names (e.g. prod-*) | |
| max_images_per_repo | No | Latest-pushed N images per repo, plus any tag named 'latest' (default: 3) | |
| platform_preference | No | Platform preference order for multi-arch manifest lists, e.g. ['linux/amd64', 'linux/arm64'] (default) | |
| max_binary_scan_bytes | No | Cap on decompressed bytes stream-scanned per candidate binary (default: 64 MB) |