ECR repository should have scan-on-push enabled

What it checks

ECR repository: scan-on-push is not enabled.

Where it applies

Terraform: aws_ecr_repository

CloudFormation: AWS::ECR::Repository

How to fix it

1. Set image_scanning_configuration { scan_on_push = true }. Basic scanning is free to turn on; enhanced scanning is billed separately.

Frameworks

• AWS FSBP ECR.1
• SOC 2 CC7.1
• NIST 800-53 rev5 SI-2

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules