README
¶
AWS ECR Continuous Scan Operator
A basic operator to control image scans in AWS ECR on a schedule.
Motivation
While AWS ECR has the ability to specify scanning on a schedule, this feature set does not exist in GovCloud. I wanted a way to periodically trigger scans on a set of images so that, in combination with an AWS ECR Prometheus exporter, I can be kept up-to-date about the results of these scans.
Implementation
This project makes use of chrono, a Golang scheduler as well as the AWS SDK (v2) for Golang to get information about repositories and images and to trigger image scans. For configuration this project uses viper. For observability this project uses logrus for logging as well as http and the Prometheus Golang modules for exposing metrics.
Usage
Given the small scope of this operator, configuring it is relatively simple.
All configuration is done via environment variables that are prefixed with AWS_ECR_SCAN, with a following _ to separate the namespace from the configuration element.
Below is a table of all current configuration elements.
| Element | Environment Variable | Default | Values | Description |
|---|---|---|---|---|
cron.schedule |
AWS_ECR_SCAN_CRON_SCHEDULE |
0 0 0 * * * |
N/A | The cron schedule for triggering the scan operator. |
images.filter.tag.status |
AWS_ECR_SCAN_IMAGES_FILTER_TAG_STATUS |
any |
any,tagged,untagged |
Filter images to trigger scans on by tag status. |
log.format |
AWS_ECR_SCAN_LOG_FORMAT |
logfmt |
json,logfmt,text |
The format of the logging output. |
log.level |
AWS_ECR_SCAN_LOG_LEVEL |
info |
debug,info,warn,error,fatal |
The log level for the logging output. |
web.host |
AWS_ECR_SCAN_WEB_HOST |
0.0.0.0 |
N/A | The host to bind to for the webserver. |
web.port |
AWS_ECR_SCAN_WEB_PORT |
9090 |
N/A | The port to bind to for the webserver. |
Permissions
Since this operator interacts with the AWS ECR API it will need to run under a role with the proper AWS IAM permissions in order to perform the necessary operations. Below is a list of all permissions this operators needs to be permitted to do.
| AWS IAM Action |
|---|
ecr:DescribeRepositories |
ecr:ListImages |
ecr:StartImageScan |
Metrics
This operator comes with a webserver to export some simple Prometheus metrics to track its operation in addition to the standard Golang Prometheus metrics. The table below describes the metrics exported.
| Name | Type | Description |
|---|---|---|
aws_ecr_scans_requested |
Counter | The total count of AWS ECR image scan requests sent. |
aws_ecr_scans_requested_errors |
Counter | The total count of AWS ECR image scan requests that results in an error. |
aws_ecr_scans_rate_limited |
Counter | The total count of AWS ECR image scan requests rejected due to rate-limiting. |
Documentation
¶
There is no documentation for this package.
Source Files