Find ECR Repositories Without Image Scanning and Enable It

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RegistryAndRegions",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "ecr:GetRegistryScanningConfiguration",
        "ecr:DescribeRepositories"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadRepositoriesAndFindings",
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGetRepositoryScanningConfiguration",
        "ecr:DescribeImages",
        "ecr:DescribeImageScanFindings"
      ],
      "Resource": "arn:aws:ecr:*:111122223333:repository/*"
    },
    {
      "Sid": "PutRegistryScanningApplyOnly",
      "Effect": "Allow",
      "Action": "ecr:PutRegistryScanningConfiguration",
      "Resource": "*"
    },
    {
      "Sid": "EnhancedScanningApplyOnly",
      "Effect": "Allow",
      "Action": [
        "inspector2:Enable",
        "inspector2:ListAccountPermissions",
        "inspector2:ListFindings",
        "inspector2:ListCoverage"
      ],
      "Resource": "*"
    },
    {
      "Sid": "InspectorServiceLinkedRoleApplyOnly",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "inspector2.amazonaws.com"
        }
      }
    }
  ]
}

// enable-ecr-image-scanning.ts
// Reports the ECR registry scanning type (BASIC or ENHANCED) in each Region, the effective scan frequency of
// every private repository, and the scan status and CRITICAL/HIGH counts of each repository's newest image.
// Dry run by default: with --apply it adds a registry scanning rule that matches every repository
// (scan on push for basic; add --enhanced for Amazon Inspector, --continuous for continuous scanning).
// Usage: npx tsx enable-ecr-image-scanning.ts [--regions=us-east-1] [--apply [--enhanced [--continuous]]]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  ECRClient,
  GetRegistryScanningConfigurationCommand,
  PutRegistryScanningConfigurationCommand,
  BatchGetRepositoryScanningConfigurationCommand,
  DescribeImageScanFindingsCommand,
  paginateDescribeRepositories,
  paginateDescribeImages,
  type ImageDetail,
  type RegistryScanningRule,
  type ScanFrequency,
} from "@aws-sdk/client-ecr";

const args = process.argv.slice(2);
const apply = args.includes("--apply");
const enhanced = args.includes("--enhanced");
const continuous = args.includes("--continuous");
const regionArg = args.find((a) => a.startsWith("--regions="))?.split("=")[1]?.split(",").map((s) => s.trim()).filter(Boolean);
if (continuous && !enhanced) {
  console.error("--continuous needs --enhanced (basic scanning supports scan on push and manual scans only)");
  process.exit(1);
}

interface Row {
  Region: string;
  Repository: string;
  Frequency: string;
  LatestImage: string;
  ScanStatus: string;
  Critical: number | string;
  High: number | string;
}

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg;
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({}));
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

async function newestImage(ecr: ECRClient, repositoryName: string): Promise<ImageDetail | undefined> {
  let newest: ImageDetail | undefined;
  for await (const page of paginateDescribeImages({ client: ecr }, { repositoryName })) {
    for (const img of page.imageDetails ?? []) {
      if (!newest || (img.imagePushedAt?.getTime() ?? 0) > (newest.imagePushedAt?.getTime() ?? 0)) newest = img;
    }
  }
  return newest;
}

async function scanSummary(ecr: ECRClient, repositoryName: string, img: ImageDetail): Promise<Pick<Row, "ScanStatus" | "Critical" | "High">> {
  try {
    const out = await ecr.send(new DescribeImageScanFindingsCommand({ repositoryName, imageId: { imageDigest: img.imageDigest }, maxResults: 1 }));
    const counts = out.imageScanFindings?.findingSeverityCounts ?? {};
    return { ScanStatus: out.imageScanStatus?.status ?? "?", Critical: counts.CRITICAL ?? 0, High: counts.HIGH ?? 0 };
  } catch (err) {
    const name = err instanceof Error ? err.name : String(err);
    return { ScanStatus: name === "ScanNotFoundException" ? "NEVER SCANNED" : name, Critical: "-", High: "-" };
  }
}

// Keep the existing rules that stay valid, and make the target frequency match every repository ("*").
function newRules(current: RegistryScanningRule[], target: ScanFrequency): RegistryScanningRule[] {
  const valid: ScanFrequency[] = enhanced ? ["SCAN_ON_PUSH", "CONTINUOUS_SCAN"] : ["SCAN_ON_PUSH"];
  const kept = current.filter((r) => r.scanFrequency && valid.includes(r.scanFrequency) && r.scanFrequency !== target);
  return [...kept, { scanFrequency: target, repositoryFilters: [{ filter: "*", filterType: "WILDCARD" }] }];
}

async function scanRegion(region: string): Promise<Row[]> {
  const ecr = new ECRClient({ region });
  const config = (await ecr.send(new GetRegistryScanningConfigurationCommand({}))).scanningConfiguration;
  const scanType = config?.scanType ?? "BASIC";
  const names: string[] = [];
  for await (const page of paginateDescribeRepositories({ client: ecr }, {})) {
    for (const repo of page.repositories ?? []) if (repo.repositoryName) names.push(repo.repositoryName);
  }
  if (!names.length) return [];
  console.log(`${region}: ${scanType} scanning, ${config?.rules?.length ?? 0} rule(s), ${names.length} repository(ies)`);

  const frequency = new Map<string, string>();
  for (let i = 0; i < names.length; i += 25) {
    const out = await ecr.send(new BatchGetRepositoryScanningConfigurationCommand({ repositoryNames: names.slice(i, i + 25) }));
    for (const c of out.scanningConfigurations ?? []) frequency.set(c.repositoryName ?? "", c.scanFrequency ?? "?");
  }

  const rows: Row[] = [];
  for (const name of names) {
    const img = await newestImage(ecr, name);
    const base = { Region: region, Repository: name, Frequency: `${scanType}/${frequency.get(name) ?? "?"}` };
    if (!img?.imageDigest) {
      rows.push({ ...base, LatestImage: "(empty)", ScanStatus: "-", Critical: "-", High: "-" });
      continue;
    }
    const pushed = img.imagePushedAt?.toISOString().slice(0, 10) ?? "?";
    rows.push({ ...base, LatestImage: `${img.imageTags?.[0] ?? img.imageDigest.slice(7, 19)} (${pushed})`, ...(await scanSummary(ecr, name, img)) });
  }

  const unscanned = names.filter((n) => !["SCAN_ON_PUSH", "CONTINUOUS_SCAN"].includes(frequency.get(n) ?? ""));
  if (apply && unscanned.length) {
    const target: ScanFrequency = continuous ? "CONTINUOUS_SCAN" : "SCAN_ON_PUSH";
    const rules = newRules(config?.rules ?? [], target);
    await ecr.send(new PutRegistryScanningConfigurationCommand({ scanType: enhanced ? "ENHANCED" : "BASIC", rules }));
    console.log(`${region}: registry set to ${enhanced ? "ENHANCED" : "BASIC"} with ${target} for "*" (${unscanned.length} repository(ies) were not scanned automatically)`);
  }
  return rows;
}

async function main(): Promise<void> {
  if (apply && enhanced) console.log("Enhanced scanning is billed by Amazon Inspector per image scanned and rescanned.");
  const rows: Row[] = [];
  for (const region of await listRegions()) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? err.name : String(err)}`);
    }
  }
  const auto = (r: Row) => /SCAN_ON_PUSH|CONTINUOUS_SCAN/.test(r.Frequency);
  rows.sort((a, b) => Number(auto(a)) - Number(auto(b)) || (Number(b.Critical) || 0) - (Number(a.Critical) || 0));
  console.table(rows);
  const manual = rows.filter((r) => !auto(r)).length;
  console.log(`${rows.length} repository(ies); ${manual} without automatic scanning.`);
  if (!apply && manual) {
    console.log("Dry run. Re-run with --apply (basic scan on push) or --apply --enhanced (Amazon Inspector).");
    process.exitCode = 2;
  }
}

main().catch((err) => {
  console.error(err instanceof Error ? `${err.name}: ${err.message}` : err);
  process.exit(1);
});

npm install @aws-sdk/client-ecr @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report every enabled Region (dry run)
AWS_PROFILE=security-audit npx tsx enable-ecr-image-scanning.ts

# Basic scan on push for every repository in two Regions
AWS_PROFILE=platform-admin npx tsx enable-ecr-image-scanning.ts --regions=us-east-1,eu-west-1 --apply

# Amazon Inspector, continuous scanning for every repository
AWS_PROFILE=platform-admin npx tsx enable-ecr-image-scanning.ts --regions=us-east-1 --apply --enhanced --continuous

eu-west-1: BASIC scanning, 0 rule(s), 2 repository(ies)
us-east-1: BASIC scanning, 1 rule(s), 3 repository(ies)
┌─────────┬─────────────┬──────────────────┬──────────────────────┬─────────────────────────────┬─────────────────┬──────────┬──────┐
│ (index) │ Region      │ Repository       │ Frequency            │ LatestImage                 │ ScanStatus      │ Critical │ High │
├─────────┼─────────────┼──────────────────┼──────────────────────┼─────────────────────────────┼─────────────────┼──────────┼──────┤
│ 0       │ 'eu-west-1' │ 'billing-worker' │ 'BASIC/MANUAL'       │ 'v2.14.0 (2026-09-21)'      │ 'NEVER SCANNED' │ '-'      │ '-'  │
│ 1       │ 'eu-west-1' │ 'legacy/cron'    │ 'BASIC/MANUAL'       │ 'latest (2025-11-03)'       │ 'COMPLETE'      │ 2        │ 9    │
│ 2       │ 'us-east-1' │ 'web-frontend'   │ 'BASIC/SCAN_ON_PUSH' │ '3f9c1e7a2b40 (2026-09-26)' │ 'COMPLETE'      │ 1        │ 4    │
│ 3       │ 'us-east-1' │ 'api'            │ 'BASIC/SCAN_ON_PUSH' │ 'v5.2.1 (2026-09-27)'       │ 'COMPLETE'      │ 0        │ 2    │
│ 4       │ 'us-east-1' │ 'sandbox'        │ 'BASIC/SCAN_ON_PUSH' │ '(empty)'                   │ '-'             │ '-'      │ '-'  │
└─────────┴─────────────┴──────────────────┴──────────────────────┴─────────────────────────────┴─────────────────┴──────────┴──────┘
5 repository(ies); 2 without automatic scanning.
Dry run. Re-run with --apply (basic scan on push) or --apply --enhanced (Amazon Inspector).