ECR repository should use KMS encryption rather than AES256

What it checks

ECR repository: encryption type is not KMS (default AES256 uses an S3-managed key).

Where it applies

Terraform: aws_ecr_repository

CloudFormation: AWS::ECR::Repository

How to fix it

1. Create a KMS CMK and set encryption_configuration { encryption_type = "KMS" kms_key = <arn> }. Note: changing encryption type requires repository recreation.

Frameworks

• AWS FSBP ECR.5
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules