Skip to content

[FEATURE] Amazon Inspector ECR re-scan settings - allow for more options #300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joegajeckyj opened this issue May 8, 2025 · 1 comment
Labels

Comments

@joegajeckyj
Copy link

Is your feature request related to a problem? Please describe

Currently only able to set the re-scan duration for inspector to LIFETIME|DAYS_30|DAYS_180

params.update(parameter_pattern_validator("ECR_SCAN_DURATION", os.environ.get("ECR_SCAN_DURATION"), pattern=r"^(LIFETIME|DAYS_30|DAYS_180){1}$"))

Describe the solution you'd like

Allow all the selections that the API accepts i.e.

response = client.update_configuration(
    ec2Configuration={
        'scanMode': 'EC2_SSM_AGENT_BASED'|'EC2_HYBRID'
    },
    ecrConfiguration={
        'pullDateRescanDuration': 'DAYS_14'|'DAYS_30'|'DAYS_60'|'DAYS_90'|'DAYS_180',
        'rescanDuration': 'LIFETIME'|'DAYS_30'|'DAYS_180'|'DAYS_14'|'DAYS_60'|'DAYS_90'
    }
)

Describe alternatives you've considered

we have set to 30 for now while we await the ability to set lower

Additional context

Parameter setting in sra-inspector-org-main-ssm.json
{
"ParameterKey": "pEcrRescanDuration",
"ParameterValue": "LIFETIME"
}

@joegajeckyj
Copy link
Author

Additionally there is a bug with the boto3 current lambda that if you set the pullDateRescanDuration manually in the delegated admin account that it gets reset to default 90 days the next time the lambda runs, so it should be also added that you can set this value too

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant