ECR Image Scanning in Java: Complete Guide

Introduction to ECR Image Scanning

Amazon ECR (Elastic Container Registry) provides built-in image scanning that identifies software vulnerabilities in container images. When combined with Java applications, it helps maintain secure container deployments by scanning for CVEs and providing detailed vulnerability reports.

System Architecture Overview

ECR Image Scanning Pipeline ├── Image Building │ ├ - Secure Dockerfile │ ├ - Multi-stage Builds │ ├ - Base Image Security │ └ - Dependency Management ├── ECR Integration │ ├ - Image Push │ ├ - Automated Scanning │ ├ - Vulnerability Assessment │ └ - Scan Results ├── Security Gates │ ├ - CVSS Thresholds │ ├ - Policy Enforcement │ ├ - Manual Approval │ └ - Break-glass Procedures └── Results & Actions ├ - EventBridge Events ├ - SNS Notifications ├ - Lambda Remediation └ - Security Dashboards

Core Implementation

1. AWS SDK Dependencies & Configuration

Maven Configuration

<properties> <aws.java.sdk.version>2.20.0</aws.java.sdk.version> <spring.cloud.aws.version>2.4.4</spring.cloud.aws.version> </properties> <dependencies> <!-- AWS SDK v2 --> <dependency> <groupId>software.amazon.awssdk</groupId> <artifactId>ecr</artifactId> <version>${aws.java.sdk.version}</version> </dependency> <dependency> <groupId>software.amazon.awssdk</groupId> <artifactId>ecrpublic</artifactId> <version>${aws.java.sdk.version}</version> </dependency> <dependency> <groupId>software.amazon.awssdk</groupId> <artifactId>lambda</artifactId> <version>${aws.java.sdk.version}</version> </dependency> <dependency> <groupId>software.amazon.awssdk</groupId> <artifactId>eventbridge</artifactId> <version>${aws.java.sdk.version}</version> </dependency> <dependency> <groupId>software.amazon.awssdk</groupId> <artifactId>sns</artifactId> <version>${aws.java.sdk.version}</version> </dependency> <!-- Spring Cloud AWS --> <dependency> <groupId>io.awspring.cloud</groupId> <artifactId>spring-cloud-aws-starter</artifactId> <version>${spring.cloud.aws.version}</version> </dependency> <!-- JSON Processing --> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.15.2</version> </dependency> <!-- Logging --> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> <version>2.0.9</version> </dependency> </dependencies>

AWS Configuration Class

@Configuration @EnableConfigurationProperties(AwsProperties.class) public class AwsConfig { @Value("${aws.region:us-east-1}") private String region; @Bean @Primary public AwsCredentialsProvider awsCredentialsProvider() { return DefaultCredentialsProvider.create(); } @Bean public EcrClient ecrClient(AwsCredentialsProvider credentialsProvider) { return EcrClient.builder() .region(Region.of(region)) .credentialsProvider(credentialsProvider) .build(); } @Bean public EventBridgeClient eventBridgeClient(AwsCredentialsProvider credentialsProvider) { return EventBridgeClient.builder() .region(Region.of(region)) .credentialsProvider(credentialsProvider) .build(); } @Bean public LambdaClient lambdaClient(AwsCredentialsProvider credentialsProvider) { return LambdaClient.builder() .region(Region.of(region)) .credentialsProvider(credentialsProvider) .build(); } @Bean public SnsClient snsClient(AwsCredentialsProvider credentialsProvider) { return SnsClient.builder() .region(Region.of(region)) .credentialsProvider(credentialsProvider) .build(); } } @ConfigurationProperties(prefix = "aws") @Data public class AwsProperties { private String region = "us-east-1"; private String accountId; private Ecr ecr = new Ecr(); @Data public static class Ecr { private String repositoryName = "my-java-app"; private String scanOnPush = "true"; private String scanFrequency = "SCAN_ON_PUSH"; private List<String> scanFilters = List.of("CRITICAL", "HIGH"); } }

2. ECR Image Scanning Service

Core Scanning Service

@Service @Slf4j public class EcrScanService { private final EcrClient ecrClient; private final AwsProperties awsProperties; private final ObjectMapper objectMapper; public EcrScanService(EcrClient ecrClient, AwsProperties awsProperties, ObjectMapper objectMapper) { this.ecrClient = ecrClient; this.awsProperties = awsProperties; this.objectMapper = objectMapper; } /** * Trigger ECR image scan for a specific image tag */ public StartImageScanResponse triggerImageScan(String repositoryName, String imageTag) { try { StartImageScanRequest request = StartImageScanRequest.builder() .repositoryName(repositoryName) .imageId(ImageIdentifier.builder().imageTag(imageTag).build()) .build(); StartImageScanResponse response = ecrClient.startImageScan(request); log.info("Started ECR image scan for {}/{}", repositoryName, imageTag); return response; } catch (EcrException e) { log.error("Failed to start ECR image scan for {}/{}: {}", repositoryName, imageTag, e.getMessage()); throw new EcrScanException("Failed to start image scan", e); } } /** * Get detailed scan findings for an image */ public DescribeImageScanFindingsResponse getScanFindings(String repositoryName, String imageTag) { try { DescribeImageScanFindingsRequest request = DescribeImageScanFindingsRequest.builder() .repositoryName(repositoryName) .imageId(ImageIdentifier.builder().imageTag(imageTag).build()) .maxResults(100) .build(); return ecrClient.describeImageScanFindings(request); } catch (EcrException e) { log.error("Failed to get scan findings for {}/{}: {}", repositoryName, imageTag, e.getMessage()); throw new EcrScanException("Failed to get scan findings", e); } } /** * Wait for scan completion and return results */ public ImageScanResult waitForScanCompletion(String repositoryName, String imageTag, Duration timeout) { Instant startTime = Instant.now(); Duration pollInterval = Duration.ofSeconds(10); while (Duration.between(startTime, Instant.now()).compareTo(timeout) < 0) { try { DescribeImageScanFindingsResponse response = getScanFindings(repositoryName, imageTag); ImageScanFindings findings = response.imageScanFindings(); if (findings != null && findings.imageScanStatus() != null) { ImageScanStatus status = findings.imageScanStatus(); if (status.status() == ScanStatus.COMPLETE) { return parseScanResults(findings, repositoryName, imageTag); } else if (status.status() == ScanStatus.FAILED) { throw new EcrScanException("Image scan failed: " + status.description()); } // If scan is in progress, continue waiting } Thread.sleep(pollInterval.toMillis()); } catch (InterruptedException e) { Thread.currentThread().interrupt(); throw new EcrScanException("Scan wait interrupted", e); } } throw new EcrScanException("Scan timeout after " + timeout); } /** * Parse and analyze scan results */ private ImageScanResult parseScanResults(ImageScanFindings findings, String repositoryName, String imageTag) { ImageScanResult result = new ImageScanResult(); result.setRepositoryName(repositoryName); result.setImageTag(imageTag); result.setScanCompletedAt(findings.imageScanCompletedAt()); result.setVulnerabilitySourceUpdatedAt(findings.vulnerabilitySourceUpdatedAt()); // Analyze findings by severity if (findings.findings() != null) { Map<String, List<Vulnerability>> vulnerabilitiesBySeverity = findings.findings().stream() .collect(Collectors.groupingBy( Finding::getSeverity, Collectors.mapping(this::convertToVulnerability, Collectors.toList()) )); result.setVulnerabilitiesBySeverity(vulnerabilitiesBySeverity); result.setTotalFindings(findings.findings().size()); // Calculate risk score result.setRiskScore(calculateRiskScore(vulnerabilitiesBySeverity)); } // Check enhanced findings if available if (findings.enhancedFindings() != null) { result.setEnhancedFindings(findings.enhancedFindings().stream() .map(this::convertToEnhancedFinding) .collect(Collectors.toList())); } return result; } /** * Calculate risk score based on vulnerability severity */ private double calculateRiskScore(Map<String, List<Vulnerability>> vulnerabilitiesBySeverity) { double score = 0.0; score += vulnerabilitiesBySeverity.getOrDefault("CRITICAL", List.of()).size() * 10.0; score += vulnerabilitiesBySeverity.getOrDefault("HIGH", List.of()).size() * 5.0; score += vulnerabilitiesBySeverity.getOrDefault("MEDIUM", List.of()).size() * 2.0; score += vulnerabilitiesBySeverity.getOrDefault("LOW", List.of()).size() * 0.5; score += vulnerabilitiesBySeverity.getOrDefault("INFORMATIONAL", List.of()).size() * 0.1; return score; } /** * Check if image passes security gates */ public SecurityGateResult checkSecurityGates(ImageScanResult scanResult, SecurityGateConfig config) { SecurityGateResult result = new SecurityGateResult(); result.setScanResult(scanResult); result.setConfig(config); Map<String, List<Vulnerability>> vulnerabilities = scanResult.getVulnerabilitiesBySeverity(); // Check critical vulnerabilities int criticalCount = vulnerabilities.getOrDefault("CRITICAL", List.of()).size(); if (criticalCount > config.getMaxCritical()) { result.addFailure("CRITICAL", String.format("Found %d critical vulnerabilities, maximum allowed: %d", criticalCount, config.getMaxCritical())); } // Check high vulnerabilities int highCount = vulnerabilities.getOrDefault("HIGH", List.of()).size(); if (highCount > config.getMaxHigh()) { result.addFailure("HIGH", String.format("Found %d high vulnerabilities, maximum allowed: %d", highCount, config.getMaxHigh())); } // Check risk score if (scanResult.getRiskScore() > config.getMaxRiskScore()) { result.addFailure("RISK_SCORE", String.format("Risk score %.2f exceeds maximum allowed: %.2f", scanResult.getRiskScore(), config.getMaxRiskScore())); } result.setPassed(result.getFailures().isEmpty()); return result; } /** * Get scan findings with pagination */ public List<Finding> getAllScanFindings(String repositoryName, String imageTag) { List<Finding> allFindings = new ArrayList<>(); String nextToken = null; do { DescribeImageScanFindingsRequest request = DescribeImageScanFindingsRequest.builder() .repositoryName(repositoryName) .imageId(ImageIdentifier.builder().imageTag(imageTag).build()) .nextToken(nextToken) .maxResults(100) .build(); DescribeImageScanFindingsResponse response = ecrClient.describeImageScanFindings(request); if (response.imageScanFindings() != null && response.imageScanFindings().findings() != null) { allFindings.addAll(response.imageScanFindings().findings()); } nextToken = response.nextToken(); } while (nextToken != null); return allFindings; } /** * Convert AWS Finding to domain Vulnerability */ private Vulnerability convertToVulnerability(Finding finding) { Vulnerability vulnerability = new Vulnerability(); vulnerability.setName(finding.name()); vulnerability.setSeverity(finding.severity()); vulnerability.setUri(finding.uri()); vulnerability.setAttributes(finding.attributes()); vulnerability.setDescription(getDescriptionFromAttributes(finding.attributes())); // Extract CVSS score if available finding.attributes().stream() .filter(attr -> "CVSS2_VECTOR".equals(attr.key()) || "CVSS2_SCORE".equals(attr.key())) .forEach(attr -> { if ("CVSS2_SCORE".equals(attr.key())) { try { vulnerability.setCvssScore(Double.parseDouble(attr.value())); } catch (NumberFormatException e) { log.warn("Invalid CVSS score: {}", attr.value()); } } }); return vulnerability; } /** * Convert enhanced finding */ private EnhancedFinding convertToEnhancedFinding(software.amazon.awssdk.services.ecr.model.EnhancedFinding enhancedFinding) { return EnhancedFinding.builder() .packageVulnerabilityDetails(enhancedFinding.packageVulnerabilityDetails()) .score(enhancedFinding.score()) .scoreDetails(enhancedFinding.scoreDetails()) .severity(enhancedFinding.severity()) .status(enhancedFinding.status()) .title(enhancedFinding.title()) .type(enhancedFinding.type()) .updatedAt(enhancedFinding.updatedAt()) .build(); } private String getDescriptionFromAttributes(List<Attribute> attributes) { return attributes.stream() .filter(attr -> "description".equals(attr.key())) .map(Attribute::value) .findFirst() .orElse("No description available"); } }

3. Domain Models

Scan Result Models

@Data @Builder public class ImageScanResult { private String repositoryName; private String imageTag; private Instant scanCompletedAt; private Instant vulnerabilitySourceUpdatedAt; private Map<String, List<Vulnerability>> vulnerabilitiesBySeverity; private List<EnhancedFinding> enhancedFindings; private int totalFindings; private double riskScore; private String scanStatus; } @Data @Builder public class Vulnerability { private String name; private String severity; private String uri; private String description; private Double cvssScore; private List<Attribute> attributes; private String packageName; private String packageVersion; private String fixedInVersion; } @Data @Builder public class EnhancedFinding { private PackageVulnerabilityDetails packageVulnerabilityDetails; private Double score; private ScoreDetails scoreDetails; private String severity; private String status; private String title; private String type; private Instant updatedAt; } @Data public class SecurityGateResult { private ImageScanResult scanResult; private SecurityGateConfig config; private boolean passed; private List<String> failures = new ArrayList<>(); public void addFailure(String type, String message) { failures.add(String.format("[%s] %s", type, message)); } } @Data @Builder public class SecurityGateConfig { @Builder.Default private int maxCritical = 0; @Builder.Default private int maxHigh = 5; @Builder.Default private int maxMedium = 20; @Builder.Default private int maxLow = 50; @Builder.Default private double maxRiskScore = 15.0; @Builder.Default private List<String> allowedCves = List.of(); @Builder.Default private boolean blockOnCritical = true; } public class EcrScanException extends RuntimeException { public EcrScanException(String message) { super(message); } public EcrScanException(String message, Throwable cause) { super(message, cause); } }

4. Event-Driven Scanning with EventBridge

EventBridge Listener

@Component @Slf4j public class EcrScanEventListener { private final EcrScanService ecrScanService; private final SecurityNotificationService notificationService; private final ObjectMapper objectMapper; public EcrScanEventListener(EcrScanService ecrScanService, SecurityNotificationService notificationService, ObjectMapper objectMapper) { this.ecrScanService = ecrScanService; this.notificationService = notificationService; this.objectMapper = objectMapper; } /** * Process ECR scan completion events */ @EventListener public void handleEcrScanEvent(String eventJson) { try { EcrScanEvent event = objectMapper.readValue(eventJson, EcrScanEvent.class); if ("ECR Image Scan".equals(event.getSource()) && "aws.ecr".equals(event.getSource())) { processScanEvent(event); } } catch (Exception e) { log.error("Failed to process ECR scan event: {}", e.getMessage(), e); } } private void processScanEvent(EcrScanEvent event) { String detailType = event.getDetailType(); if ("ECR Image Scan".equals(detailType)) { EcrScanDetail detail = event.getDetail(); String repositoryName = detail.getRepositoryName(); String imageDigest = detail.getImageDigest(); log.info("Processing ECR scan event for repository: {}, digest: {}", repositoryName, imageDigest); // Get scan findings ImageScanResult scanResult = ecrScanService.waitForScanCompletion( repositoryName, getImageTagFromDigest(imageDigest), Duration.ofMinutes(5)); // Check security gates SecurityGateConfig config = getSecurityGateConfig(); SecurityGateResult gateResult = ecrScanService.checkSecurityGates(scanResult, config); // Take action based on result if (gateResult.isPassed()) { handleScanPassed(scanResult); } else { handleScanFailed(gateResult); } } } private void handleScanPassed(ImageScanResult scanResult) { log.info("ECR scan passed for {}/{} with risk score: {}", scanResult.getRepositoryName(), scanResult.getImageTag(), scanResult.getRiskScore()); // Notify success notificationService.sendScanSuccessNotification(scanResult); // Trigger deployment or next steps triggerDeploymentIfNeeded(scanResult); } private void handleScanFailed(SecurityGateResult gateResult) { ImageScanResult scanResult = gateResult.getScanResult(); log.warn("ECR scan failed for {}/{}: {}", scanResult.getRepositoryName(), scanResult.getImageTag(), String.join(", ", gateResult.getFailures())); // Send failure notification notificationService.sendScanFailureNotification(gateResult); // Block deployment if configured if (gateResult.getConfig().isBlockOnCritical()) { blockDeployment(scanResult); } } private SecurityGateConfig getSecurityGateConfig() { return SecurityGateConfig.builder() .maxCritical(0) .maxHigh(3) .maxMedium(10) .maxLow(25) .maxRiskScore(20.0) .blockOnCritical(true) .build(); } private String getImageTagFromDigest(String imageDigest) { // Extract image tag from digest // This is a simplified implementation return "latest"; // In practice, you'd need to map digest to tag } private void triggerDeploymentIfNeeded(ImageScanResult scanResult) { // Implement deployment triggering logic log.info("Triggering deployment for secure image: {}/{}", scanResult.getRepositoryName(), scanResult.getImageTag()); } private void blockDeployment(ImageScanResult scanResult) { // Implement deployment blocking logic log.warn("Blocking deployment for insecure image: {}/{}", scanResult.getRepositoryName(), scanResult.getImageTag()); } } @Data class EcrScanEvent { private String version; private String id; private String detailType; private String source; private String account; private String time; private String region; private List<String> resources; private EcrScanDetail detail; } @Data class EcrScanDetail { private String scanStatus; private String repositoryName; private Map<String, String> findingSeverityCounts; private String imageDigest; private Map<String, Object> imageTags; }

5. Security Notification Service

Notification Service

@Service @Slf4j public class SecurityNotificationService { private final SnsClient snsClient; private final ObjectMapper objectMapper; @Value("${aws.sns.security.topic.arn}") private String securityTopicArn; public SecurityNotificationService(SnsClient snsClient, ObjectMapper objectMapper) { this.snsClient = snsClient; this.objectMapper = objectMapper; } /** * Send scan success notification */ public void sendScanSuccessNotification(ImageScanResult scanResult) { try { SecurityNotification notification = SecurityNotification.builder() .type("SCAN_SUCCESS") .title("ECR Image Scan Passed") .message(buildSuccessMessage(scanResult)) .repositoryName(scanResult.getRepositoryName()) .imageTag(scanResult.getImageTag()) .riskScore(scanResult.getRiskScore()) .totalFindings(scanResult.getTotalFindings()) .timestamp(Instant.now()) .build(); sendNotification(notification); } catch (Exception e) { log.error("Failed to send scan success notification: {}", e.getMessage(), e); } } /** * Send scan failure notification */ public void sendScanFailureNotification(SecurityGateResult gateResult) { try { SecurityNotification notification = SecurityNotification.builder() .type("SCAN_FAILURE") .title("ECR Image Scan Failed Security Gates") .message(buildFailureMessage(gateResult)) .repositoryName(gateResult.getScanResult().getRepositoryName()) .imageTag(gateResult.getScanResult().getImageTag()) .riskScore(gateResult.getScanResult().getRiskScore()) .totalFindings(gateResult.getScanResult().getTotalFindings()) .failures(gateResult.getFailures()) .timestamp(Instant.now()) .build(); sendNotification(notification); } catch (Exception e) { log.error("Failed to send scan failure notification: {}", e.getMessage(), e); } } /** * Send critical vulnerability alert */ public void sendCriticalVulnerabilityAlert(ImageScanResult scanResult, List<Vulnerability> criticalVulns) { try { SecurityNotification notification = SecurityNotification.builder() .type("CRITICAL_VULNERABILITY") .title("Critical Vulnerabilities Detected") .message(buildCriticalAlertMessage(scanResult, criticalVulns)) .repositoryName(scanResult.getRepositoryName()) .imageTag(scanResult.getImageTag()) .riskScore(scanResult.getRiskScore()) .criticalVulnerabilities(criticalVulns) .timestamp(Instant.now()) .build(); sendNotification(notification); } catch (Exception e) { log.error("Failed to send critical vulnerability alert: {}", e.getMessage(), e); } } private void sendNotification(SecurityNotification notification) { try { String message = objectMapper.writeValueAsString(notification); PublishRequest request = PublishRequest.builder() .topicArn(securityTopicArn) .message(message) .subject(notification.getTitle()) .build(); snsClient.publish(request); log.info("Sent security notification: {}", notification.getType()); } catch (Exception e) { log.error("Failed to publish SNS notification: {}", e.getMessage(), e); throw new RuntimeException("Notification failed", e); } } private String buildSuccessMessage(ImageScanResult scanResult) { return String.format( "ECR image scan passed for %s/%s\n" + "Risk Score: %.2f\n" + "Total Findings: %d\n" + "Scan Completed: %s", scanResult.getRepositoryName(), scanResult.getImageTag(), scanResult.getRiskScore(), scanResult.getTotalFindings(), scanResult.getScanCompletedAt() ); } private String buildFailureMessage(SecurityGateResult gateResult) { ImageScanResult scanResult = gateResult.getScanResult(); StringBuilder message = new StringBuilder(); message.append(String.format( "ECR image scan FAILED security gates for %s/%s\n" + "Risk Score: %.2f (Max: %.2f)\n" + "Total Findings: %d\n\n" + "Failures:\n", scanResult.getRepositoryName(), scanResult.getImageTag(), scanResult.getRiskScore(), gateResult.getConfig().getMaxRiskScore(), scanResult.getTotalFindings() )); for (String failure : gateResult.getFailures()) { message.append("• ").append(failure).append("\n"); } return message.toString(); } private String buildCriticalAlertMessage(ImageScanResult scanResult, List<Vulnerability> criticalVulns) { StringBuilder message = new StringBuilder(); message.append(String.format( "CRITICAL VULNERABILITIES DETECTED in %s/%s\n\n" + "Critical Vulnerabilities Found: %d\n\n", scanResult.getRepositoryName(), scanResult.getImageTag(), criticalVulns.size() )); for (int i = 0; i < Math.min(criticalVulns.size(), 5); i++) { Vulnerability vuln = criticalVulns.get(i); message.append(String.format("%d. %s\n", i + 1, vuln.getName())); if (vuln.getDescription() != null) { message.append(" Description: ").append( vuln.getDescription().length() > 100 ? vuln.getDescription().substring(0, 100) + "..." : vuln.getDescription() ).append("\n"); } message.append("\n"); } if (criticalVulns.size() > 5) { message.append(String.format("... and %d more critical vulnerabilities\n", criticalVulns.size() - 5)); } return message.toString(); } } @Data @Builder class SecurityNotification { private String type; private String title; private String message; private String repositoryName; private String imageTag; private double riskScore; private int totalFindings; private List<String> failures; private List<Vulnerability> criticalVulnerabilities; private Instant timestamp; }

6. GitHub Actions Integration

ECR Scan Workflow

name: "ECR Image Security Scan" on: push: branches: [ main, develop ] tags: [ 'v*' ] pull_request: branches: [ main, develop ] workflow_dispatch: env: AWS_REGION: us-east-1 ECR_REPOSITORY: my-java-app IMAGE_TAG: ${{ github.sha }} permissions: id-token: write contents: read jobs: build-scan-deploy: name: Build, Scan, and Deploy runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Set up JDK 17 uses: actions/setup-java@v4 with: java-version: '17' distribution: 'temurin' cache: 'maven' - name: Build with Maven run: mvn clean package -DskipTests - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN }} aws-region: ${{ env.AWS_REGION }} - name: Login to Amazon ECR id: login-ecr uses: aws-actions/amazon-ecr-login@v2 - name: Build Docker image run: | docker build \ --tag ${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }} \ --file Dockerfile \ . - name: Push image to ECR run: | docker push ${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }} - name: Wait for ECR scan completion run: | # Wait for ECR scan to complete echo "Waiting for ECR scan to complete..." sleep 60 # Check scan status using AWS CLI SCAN_STATUS=$(aws ecr describe-image-scan-findings \ --repository-name ${{ env.ECR_REPOSITORY }} \ --image-id imageTag=${{ env.IMAGE_TAG }} \ --query 'imageScanFindings.imageScanStatus.status' \ --output text) echo "ECR Scan Status: $SCAN_STATUS" # Wait up to 5 minutes for scan completion COUNTER=0 while [ "$SCAN_STATUS" != "COMPLETE" ] && [ $COUNTER -lt 30 ]; do sleep 10 SCAN_STATUS=$(aws ecr describe-image-scan-findings \ --repository-name ${{ env.ECR_REPOSITORY }} \ --image-id imageTag=${{ env.IMAGE_TAG }} \ --query 'imageScanFindings.imageScanStatus.status' \ --output text) echo "ECR Scan Status: $SCAN_STATUS (Attempt $((COUNTER + 1)))" COUNTER=$((COUNTER + 1)) done if [ "$SCAN_STATUS" != "COMPLETE" ]; then echo "ECR scan did not complete in time" exit 1 fi - name: Check ECR scan results run: | # Get scan findings aws ecr describe-image-scan-findings \ --repository-name ${{ env.ECR_REPOSITORY }} \ --image-id imageTag=${{ env.IMAGE_TAG }} \ --query 'imageScanFindings.findings[?severity==`CRITICAL`]' \ --output table # Check for critical vulnerabilities CRITICAL_COUNT=$(aws ecr describe-image-scan-findings \ --repository-name ${{ env.ECR_REPOSITORY }} \ --image-id imageTag=${{ env.IMAGE_TAG }} \ --query 'length(imageScanFindings.findings[?severity==`CRITICAL`])' \ --output text) echo "Critical vulnerabilities found: $CRITICAL_COUNT" if [ "$CRITICAL_COUNT" -gt 0 ]; then echo "❌ Critical vulnerabilities detected. Failing build." exit 1 fi # Check for high vulnerabilities HIGH_COUNT=$(aws ecr describe-image-scan-findings \ --repository-name ${{ env.ECR_REPOSITORY }} \ --image-id imageTag=${{ env.IMAGE_TAG }} \ --query 'length(imageScanFindings.findings[?severity==`HIGH`])' \ --output text) echo "High vulnerabilities found: $HIGH_COUNT" if [ "$HIGH_COUNT" -gt 5 ]; then echo "❌ Too many high vulnerabilities detected. Failing build." exit 1 fi - name: Trigger deployment on success if: success() run: | echo "ECR scan passed. Triggering deployment..." # Add deployment logic here - name: Notify on failure if: failure() run: | echo "ECR scan failed. Sending notifications..." # Add failure notification logic here

7. Secure Dockerfile for Java Applications

Security-Hardened Dockerfile

# Multi-stage build for security FROM eclipse-temurin:17-jdk-jammy as builder # Security: Install security updates RUN apt-get update && \ apt-get upgrade -y && \ rm -rf /var/lib/apt/lists/* # Create non-root user RUN groupadd -r spring && useradd -r -g spring spring USER spring:spring WORKDIR /app # Copy dependency files COPY --chown=spring:spring mvnw . COPY --chown=spring:spring .mvn .mvn COPY --chown=spring:spring pom.xml . # Download dependencies RUN ./mvnw dependency:go-offline -B # Copy source code COPY --chown=spring:spring src src # Build application RUN ./mvnw clean package -DskipTests # Runtime stage FROM eclipse-temurin:17-jre-jammy as runtime # Security: Install security updates and minimal packages RUN apt-get update && \ apt-get upgrade -y && \ apt-get install -y --no-install-recommends \ curl \ ca-certificates && \ rm -rf /var/lib/apt/lists/* && \ apt-get clean # Security: Create non-root user RUN groupadd -r spring && useradd -r -g spring spring # Security: Create app directory with proper permissions RUN mkdir -p /app && chown spring:spring /app WORKDIR /app USER spring:spring # Copy JAR from builder stage COPY --from=builder --chown=spring:spring /app/target/*.jar app.jar # Security: Use secure JVM options ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom -Djava.awt.headless=true -Dfile.encoding=UTF-8" # Security: Health check HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ CMD curl -f http://localhost:8080/actuator/health || exit 1 # Security: Expose non-privileged port EXPOSE 8080 # Security: Use exec form ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]

8. Application Configuration

application.yml

# Application Configuration spring: application: name: ecr-scan-service security: scan: enabled: true timeout-minutes: 10 max-critical: 0 max-high: 5 max-risk-score: 15.0 # AWS Configuration aws: region: ${AWS_REGION:us-east-1} account-id: ${AWS_ACCOUNT_ID:} ecr: repository-name: ${ECR_REPOSITORY:my-java-app} scan-on-push: true scan-frequency: SCAN_ON_PUSH sns: security-topic-arn: ${SNS_SECURITY_TOPIC_ARN:} # Security Configuration security: notifications: enabled: true slack-webhook: ${SLACK_SECURITY_WEBHOOK:} email: ${SECURITY_TEAM_EMAIL:} gates: block-on-critical: true require-approval-for-high: true auto-remediate-low: false # Logging logging: level: com.example.ecr: DEBUG software.amazon.awssdk: INFO pattern: level: "%5p [%X{traceId:-},%X{spanId:-}]"

9. Security Dashboard and Reporting

Security Dashboard Service

@Service @Slf4j public class SecurityDashboardService { private final EcrScanService ecrScanService; private final ObjectMapper objectMapper; public SecurityDashboardService(EcrScanService ecrScanService, ObjectMapper objectMapper) { this.ecrScanService = ecrScanService; this.objectMapper = objectMapper; } /** * Generate security dashboard data */ public SecurityDashboard generateDashboard(String repositoryName, Duration timeRange) { SecurityDashboard dashboard = new SecurityDashboard(); dashboard.setGeneratedAt(Instant.now()); dashboard.setTimeRange(timeRange); // Get recent scan results List<ImageScanResult> recentScans = getRecentScanResults(repositoryName, timeRange); dashboard.setRecentScans(recentScans); // Calculate metrics calculateMetrics(dashboard, recentScans); // Generate trends generateTrends(dashboard, recentScans); // Identify top vulnerabilities identifyTopVulnerabilities(dashboard, recentScans); return dashboard; } /** * Generate compliance report */ public ComplianceReport generateComplianceReport(String repositoryName, ComplianceStandard standard) { ComplianceReport report = new ComplianceReport(); report.setGeneratedAt(Instant.now()); report.setStandard(standard); report.setRepositoryName(repositoryName); // Get current scan results ImageScanResult currentScan = ecrScanService.waitForScanCompletion( repositoryName, "latest", Duration.ofMinutes(5)); // Check compliance against standard checkCompliance(report, currentScan, standard); return report; } private List<ImageScanResult> getRecentScanResults(String repositoryName, Duration timeRange) { // This would typically query a database of previous scan results // For now, return empty list - implement based on your storage return List.of(); } private void calculateMetrics(SecurityDashboard dashboard, List<ImageScanResult> scans) { SecurityMetrics metrics = new SecurityMetrics(); if (!scans.isEmpty()) { ImageScanResult latestScan = scans.get(0); metrics.setTotalImagesScanned(scans.size()); metrics.setCurrentRiskScore(latestScan.getRiskScore()); metrics.setCriticalVulnerabilitiesCount( latestScan.getVulnerabilitiesBySeverity() .getOrDefault("CRITICAL", List.of()).size()); metrics.setHighVulnerabilitiesCount( latestScan.getVulnerabilitiesBySeverity() .getOrDefault("HIGH", List.of()).size()); // Calculate averages double avgRiskScore = scans.stream() .mapToDouble(ImageScanResult::getRiskScore) .average() .orElse(0.0); metrics.setAverageRiskScore(avgRiskScore); } dashboard.setMetrics(metrics); } private void generateTrends(SecurityDashboard dashboard, List<ImageScanResult> scans) { List<SecurityTrend> trends = new ArrayList<>(); // Analyze risk score trend if (scans.size() >= 2) { ImageScanResult latest = scans.get(0); ImageScanResult previous = scans.get(1); double riskChange = latest.getRiskScore() - previous.getRiskScore(); trends.add(SecurityTrend.builder() .type("RISK_SCORE") .direction(riskChange > 0 ? "INCREASING" : "DECREASING") .magnitude(Math.abs(riskChange)) .build()); } dashboard.setTrends(trends); } private void identifyTopVulnerabilities(SecurityDashboard dashboard, List<ImageScanResult> scans) { if (!scans.isEmpty()) { ImageScanResult latestScan = scans.get(0); Map<String, List<Vulnerability>> vulns = latestScan.getVulnerabilitiesBySeverity(); // Get top critical/high vulnerabilities List<Vulnerability> topVulns = Stream.concat( vulns.getOrDefault("CRITICAL", List.of()).stream(), vulns.getOrDefault("HIGH", List.of()).stream() ) .sorted(Comparator.comparing(Vulnerability::getCvssScore).reversed()) .limit(10) .collect(Collectors.toList()); dashboard.setTopVulnerabilities(topVulns); } } private void checkCompliance(ComplianceReport report, ImageScanResult scan, ComplianceStandard standard) { List<ComplianceCheck> checks = new ArrayList<>(); // CIS Benchmark checks if (standard == ComplianceStandard.CIS) { checks.add(checkNonRootUser(scan)); checks.add(checkNoCriticalVulnerabilities(scan)); checks.add(checkSecurityUpdates(scan)); } // HIPAA checks if (standard == ComplianceStandard.HIPAA) { checks.add(checkEncryptionRequirements(scan)); checks.add(checkAccessControls(scan)); } report.setChecks(checks); report.setCompliant(checks.stream().allMatch(ComplianceCheck::isPassed)); } private ComplianceCheck checkNonRootUser(ImageScanResult scan) { // Check if image runs as non-root user // This would require additional metadata about the image return ComplianceCheck.builder() .name("Non-root User") .description("Container should not run as root user") .passed(true) // Simplified .build(); } private ComplianceCheck checkNoCriticalVulnerabilities(ImageScanResult scan) { int criticalCount = scan.getVulnerabilitiesBySeverity() .getOrDefault("CRITICAL", List.of()).size(); return ComplianceCheck.builder() .name("No Critical Vulnerabilities") .description("Image should have no critical severity vulnerabilities") .passed(criticalCount == 0) .details("Found " + criticalCount + " critical vulnerabilities") .build(); } // Additional compliance check methods... } @Data class SecurityDashboard { private Instant generatedAt; private Duration timeRange; private SecurityMetrics metrics; private List<SecurityTrend> trends; private List<ImageScanResult> recentScans; private List<Vulnerability> topVulnerabilities; } @Data class SecurityMetrics { private int totalImagesScanned; private double currentRiskScore; private double averageRiskScore; private int criticalVulnerabilitiesCount; private int highVulnerabilitiesCount; private int complianceViolations; } @Data @Builder class SecurityTrend { private String type; private String direction; private double magnitude; private String description; } @Data class ComplianceReport { private Instant generatedAt; private ComplianceStandard standard; private String repositoryName; private boolean compliant; private List<ComplianceCheck> checks; } @Data @Builder class ComplianceCheck { private String name; private String description; private boolean passed; private String details; } enum ComplianceStandard { CIS, HIPAA, PCI_DSS, NIST }

Best Practices

1. Secure Image Building

# Always use specific base image versions FROM eclipse-temurin:17.0.7_7-jre-jammy # Regularly update base images # Use multi-stage builds to minimize attack surface # Run as non-root user # Remove unnecessary packages

2. Scanning Automation

// Integrate scanning into CI/CD pipeline // Fail builds on critical vulnerabilities // Implement security gates with configurable thresholds // Automate remediation for low-risk issues

3. Continuous Monitoring

# Monitor for new CVEs # Track vulnerability trends # Implement automated alerts # Maintain compliance dashboards

Conclusion

This comprehensive ECR Image Scanning implementation provides:

Automated vulnerability scanning integrated with Java applications
Security gate enforcement with configurable thresholds
Event-driven notifications for security findings
Compliance reporting for various standards
Dashboard and monitoring for security metrics

Key benefits:

Early vulnerability detection in container images
Automated security enforcement in CI/CD pipelines
Comprehensive reporting for audit and compliance
Real-time alerts for critical security issues
Risk-based decision making with calculated risk scores

The setup enables organizations to maintain secure containerized Java applications while meeting compliance requirements through automated security controls and continuous monitoring.