ECR access should use VPC endpoints to avoid public internet pull

What it checks

No VPC endpoint for ECR found in this workspace.

Where it applies

Terraform: aws_vpc_endpoint

CloudFormation: AWS::EC2::VPCEndpoint

How to fix it

1. Create Interface endpoints for ecr.api and ecr.dkr. Also consider S3 Gateway endpoint (free) since ECR stores layers in S3.

Frameworks

• SOC 2 CC6.6

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules