Scoutsuite: feature request - Add feature for scanning ECR images for container vulnerabilities

[naman]

AWS recently enabled the option to scan container images stored in ECR on every image push. See - https://aws.amazon.com/about-aws/whats-new/2019/10/announcing-image-scanning-for-amazon-ecr. As a result, we'll have to upgrade the botocore (version > 1.13.3) and boto3 (version > 1.10.3) The api change was done in the botocore version 1.13.3 -> https://github.com/boto/botocore/commit/81adaabfba48cc281a37e5224838db216bfc6c06#diff-1baf8916cf3bb4421691b8a16198fd9e (see CHANGELOG https://github.com/boto/botocore/blob/develop/CHANGELOG.rst#1133) and boto3 version 1.10.3 -> see CHANGELOG https://github.com/boto/boto3/blob/develop/CHANGELOG.rst#1103.

I'd like to propose this feature to be added to the ScoutSuite and work on it.

[x4v13r64]

What exactly would you want ScoutSuite to check? That "Image Scanning" is enabled for all images?

[naman]

ScoutSuite will check the following -

1. Image Scanning is enabled for each ECR repository.
2. Trigger a manual scan in case point 1 is true.
3. Image being scanned has >0 vulnerabilities (the image will be marked dirty if it has atleast 1 vulnerability).
4. Fetch the list of vulnerabilities for each ECR repository. (each vulnerability could be a finding).

Please refer to the API docs here - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html

[x4v13r64]

Ok, well it's on the stack :sweat_smile: .

[naman]

Thanks @j4v. I'd like to work on it :)

[thommor]

Go for it @naman

[x4v13r64]

Thanks @j4v. I'd like to work on it :)

Sure, happy for you to submit a PR to implement this.

[ramimac]

Just chiming in here as I'm doing some work on AWS audit tools due to developing https://github.com/nccgroup/sadcloud.

1) I'd stay away from building out:

Trigger a manual scan in case point 1 is true.
Image being scanned has >0 vulnerabilities (the image will be marked dirty if it has atleast 1 vulnerability).
Fetch the list of vulnerabilities for each ECR repository. (each vulnerability could be a finding).

These seem to deviate from the core use-case and ethos of scoutsuite, as they would cost money and alter the enviornment

2) When implementing ECR, I'd also add a check for public ECR repositories (see: https://github.com/toniblyx/prowler/blob/master/checks/check_extra77)

[x4v13r64]

as they would cost money and alter the enviornment

Hadn't realized this would be the case. @ramimac is correct, Scout must be able to run with read-only access. That would likely mean raising if scanning is not enabled & checking if vulnerabilities have been raised where scanning has been carried out.

[klauern]

I think it would be useful to integrate checking that ECR is scanned, but with ECR having just announced scanning, you could use the ImageFindings to gather information off of that:

https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ImageScanFindings.html

So, while it wouldn't turn on scanning, you could:

1. flag if it's not enabled
2. report findings from images that it does have

[x4v13r64]

Closing, this is implemented in the proprietary build.