DADAVISDESIGN
CYBERSECURITY AND TECH CONSULTING
Shield

AWS ECR & Container Vulnerability Dashboard

ECR Image Scanning · Container CVEs · Runtime Hardening · Supply Chain Risk · Remediation Steps · 187 Findings

All Categories / Choose an ECR or Container Finding
All Categories / Choose an ECR or Container Finding
Amazon ECR Repository Security
ECR Repository Allows Public Access
ECR Repository Policy Allows Wildcard Principal
ECR Repository Allows Unreviewed Cross-Account Access
Container Repository Is Not Private
External Account Can Push Images to ECR Repository
Repository Policy Grants Image Delete Permission
Repository Policy Grants Broad Pull Access
ECR Repository Lifecycle Policy Missing
Lifecycle Policy Does Not Expire Old Images
ECR Repository Missing Environment Tag
ECR Repository Missing Owner Tag
ECR Repository Has No Recent Pull Activity
Image Scanning Configuration
ECR Basic Image Scanning Disabled
Amazon Inspector Enhanced Scanning Not Enabled
ECR Scan on Push Disabled
Continuous Image Scanning Disabled
Enhanced Scanning Filter Excludes Production Repository
Image Scan Frequency Set to Manual Only
Container Image Has Never Been Scanned
Container Image Scan Failed
Container Image Scan Results Are Stale
Vulnerability Intelligence Not Recently Refreshed
Inspector Finding Suppression Rule Not Reviewed
Inspector Findings Not Sent to Security Hub
Critical and High CVEs
Critical CVE Detected in Container Image
High CVE Detected in Container Image
Critical Container CVE Has Fix Available
High Container CVE Has Fix Available
Remote Code Execution CVE Detected
Privilege Escalation CVE Detected
Authentication Bypass CVE Detected
Known Exploited Vulnerability Detected
Public Exploit Available for Container CVE
Network-Reachable Container CVE Detected
Package Manager Vulnerability Detected
OpenSSL Critical CVE Detected in Image
glibc Critical CVE Detected in Image
Log4j Vulnerability Detected in Container Image
Spring Framework Critical CVE Detected
Base Image and OS Risk
Base Image Is End-of-Life
Unsupported Operating System in Container Image
Outdated Alpine Base Image Detected
Outdated Debian Base Image Detected
Outdated Ubuntu Base Image Detected
Base Image Pulled from Untrusted Source
Base Image Uses Latest Tag
Base Image Not Pinned by Digest
Base Image Has Large Attack Surface
Build Tools Present in Runtime Image
Package Manager Cache Present in Image
Image Does Not Use Minimal Runtime Base
Secrets and Sensitive Data in Images
AWS Access Key Detected in Container Image
Secret Key Detected in Container Image
SSH Private Key Detected in Container Image
GitHub Token Detected in Container Image
NPM Token Detected in Container Image
Docker Config Credentials Present in Image
Kubeconfig File Present in Container Image
Database Password Detected in Image Layer
API Key Detected in Container Image
TLS Private Key Detected in Image
.env File Present in Container Image
Shell History File Present in Image
Image Integrity and Supply Chain
Container Image Is Not Digitally Signed
Image Signature Verification Not Enforced
Image Build Provenance Missing
Software Bill of Materials Missing
SLSA Attestation Missing
Image Built by Untrusted Pipeline
Image Pulled from Unapproved Registry
Image Digest Not Verified Before Deployment
Container Image Tag Reused After Deployment
Image Created by Unapproved Builder
Unverified Dependencies Present in Image
Third-Party Package Risk Detected
Image Age and Patch Hygiene
Critical Image Older Than 30 Days
Container Image Older Than 90 Days
Container Image Older Than 180 Days
Image Not Rebuilt After Base Image Update
Fix Available but Image Not Updated
Repeated Critical Findings Across Image Versions
Production Image Tag Is Stale
No Recent Successful Secure Build
Container Vulnerability SLA Breached
Container Patch Window Missed
Development Image Tag Used in Production
Debug Build Deployed to Production
Container Runtime Hardening
Container Runs as Root User
Privileged Container Detected
Read-Only Root Filesystem Not Enabled
Excessive Linux Capabilities Assigned
CAP_SYS_ADMIN Capability Enabled
Host Network Mode Enabled
Host PID Namespace Enabled
Host IPC Namespace Enabled
Docker Socket Mounted into Container
Sensitive Host Path Mounted into Container
Container Resource Limits Missing
Container Health Check Missing
Seccomp Profile Set to Unconfined
AppArmor Profile Disabled
ECS and Fargate Deployment Risk
ECS Task Definition Uses Vulnerable Image
ECS Task Uses Latest Image Tag
ECS Task Image Not Pinned by Digest
ECS Task Runs Privileged Container
ECS Container Runs as Root
ECS Task Exposes Secrets as Plain Environment Variables
ECS Task Execution Role Overprivileged
ECS Task Role Overprivileged
ECS Task Logging Not Configured
ECS Deployment Circuit Breaker Disabled
ECS Service Assigns Public IP
ECS Container Insights Disabled
EKS and Kubernetes Image Risk
EKS Workload Uses Vulnerable Image
Kubernetes Workload Uses Latest Tag
Kubernetes Image Not Pinned by Digest
Privileged Kubernetes Pod Detected
Kubernetes Pod Runs as Root
Kubernetes Pod Uses HostPath Mount
Kubernetes Pod Uses Host Network
Privilege Escalation Allowed in Pod
Service Account Token Auto-Mounted
Kubernetes Workload Missing Network Policy
Admission Control Not Enforcing Image Policy
EKS Workload Pulls Image from Unapproved Registry
IAM Access to ECR and Inspector
IAM Principal Has ECR Administrative Access
IAM Principal Can Push Images Broadly
IAM Principal Can Delete Images Broadly
IAM Principal Can Manage ECR Public Repositories
IAM Principal Can Disable Inspector Scanning
ECR IAM Policy Uses Wildcard Resource
Cross-Account Role Can Access ECR Repository
CI/CD Role Overprivileged for Container Registry
Developer Role Can Bypass Image Scanning Controls
ECR Authorization Token Exposure Risk
Encryption and Logging
ECR Repository Not Encrypted with Customer Managed KMS Key
KMS Key Rotation Disabled for ECR Encryption Key
ECR CloudTrail Events Not Monitored
PutImage CloudTrail Alert Missing
DeleteImage CloudTrail Alert Missing
Repository Policy Change Alert Missing
Inspector Finding EventBridge Rule Missing
Container Findings Not Imported to Security Hub
ECR Usage Metrics Not Reviewed
Private ECR VPC Endpoint Missing
CI/CD Pipeline Controls
CI/CD Pipeline Builds Vulnerable Image
Pipeline Does Not Fail on Critical CVE
Pipeline Does Not Fail on High CVE
Container Image Scan Step Missing from Pipeline
Secrets Scan Missing from Pipeline
SBOM Generation Missing from Pipeline
Image Signing Step Missing from Pipeline
Pipeline Pushes Latest Tag to Production Repository
Pipeline Uses Long-Lived Registry Token
Unprotected Branch Can Publish Container Image
Production Image Publish Approval Missing
Build Artifact Provenance Missing
Compliance and Governance
CIS Docker Benchmark Control Failure
CIS Kubernetes Benchmark Control Failure
PCI Workload Image Contains High Vulnerabilities
HIPAA Workload Image Contains High Vulnerabilities
Production Critical Vulnerability SLA Breached
Container Vulnerability Exception Expired
Vulnerability Risk Accepted Without Owner
Container Finding Missing Remediation Ticket
Container Repository Missing Business Owner
Container Workload Missing Data Classification
Public Exposure and Network Risk
Production Workload Uses Public Container Image
Public Image Contains Critical CVE
Vulnerable Container Service Publicly Exposed
Internet Ingress Allowed to Vulnerable Container
Container Workload Has Unrestricted Egress
Container Pulls Do Not Use Private Registry Endpoint
Registry Access from Untrusted Network
Load Balancer Exposes Container Debug Port
Container Administrative Port Exposed
Container Can Reach Instance Metadata Service
Operational Response and Remediation
Critical Container Finding Unassigned
Critical Container Finding Unacknowledged
High Container Finding Open Over 7 Days
Medium Container Finding Open Over 30 Days
Container Remediation Verification Failed
Container Image Not Rescanned After Remediation
Rollback Image Contains Known Critical CVE
Critical Container CVE Suppressed by Exception
Finding Owner Notification Missing
Production Deploy Block Not Enforced for Critical CVE
📚 187 Findings | 🔥 120 Critical/High | ⚡ NIST 800-53 Aligned

☁️ AWS ECR & Container Vulnerability Dashboard

Browse by category or search above to find ECR security findings, container vulnerabilities, and remediation steps.

Each finding includes container security context, risk explanation, governance alignment, and step-by-step remediation guidance.

187 Container Findings Available:

• ECR Security - Repository access, lifecycle policy, encryption, private endpoints, and cross-account exposure

• Amazon Inspector - Enhanced scanning, critical CVEs, exploitability, fix availability, and scan hygiene

• Container Images - Base image age, unsupported OS versions, secrets, SBOM, signing, and provenance

• ECS / EKS - Vulnerable deployed images, privileged containers, root users, host mounts, and runtime hardening

• CI/CD - Pipeline scan gates, image signing, protected branches, trusted builders, and production promotion controls

AWS Official Policy Description
Trigger

Risk Description

Recommendations

    Remediation Steps

      AWS Docs View AWS Documentation

      © 2024 DADavisDesign — AWS ECR & Container Vulnerability Dashboard — Cloud Security Reference · 187 Container Findings · Enterprise Security Aligned

      🔒 Sign In Required

      Access to detailed ECR and container vulnerability content requires authentication. Sign in or create a Cyber Defenders account to unlock full access.

      With an account you get:

      • AWS ECR & Container vulnerability findings
      • Detailed remediation steps
      • Professional container security guidance

      Create your account at Cyber Defenders

      Welcome Back

      Sign in to your account

      or
      Don't have an account? Sign Up

      Create Account

      Join DADavisDesigns Cybersecurity Support

      or
      Already have an account? Sign In