ECR.Client.describe_image_scan_findings not honoring maxResults for enhancedFindings

[grimeymike-swi]

Describe the bug

Hi, I have an image that has 100 < N <= 1000 scan findings, and I've noticed that passing the maxResults parameter with the describe_image_scan_findings call does not affect the number of findings returned.

Expected Behavior

I expected that I would get back > 100 results in response['imageScanFindings']['enhancedFindings'].

Current Behavior

I get back exactly 100 findings in response['imageScanFindings']['enhancedFindings'], along with a nextToken, even though I set maxResults = 1000.

Reproduction Steps

Have an image in ECR with image-scanning enabled that has > 100 findings.

Possible Solution

my best guess is that the maxResults parameter is only applied to response['imageScanFindings']['findings'], and not response['imageScanFindings']['enhancedFindings'].

Additional Information/Context

I don't have an image that has > 100 findings instead of enhancedFindings so I can't validate my hypothesis above.

SDK version used

boto3==1.24.73 botocore==1.27.73

Environment details (OS name and version, etc.)

MacBook Pro M1 (2021), Mac OS Monterey 12.5.1, Python 3.10.6

[tim-finnigan]

Hi @grimeymike-swi thanks for reaching out. I think the documentation on this could be improved. Many service APIs have a default limit (such as 100 in this case) of results that can be retrieved in one API call. I think the wording in the DescribeImageScanFindings documentation should clarify if setting maxResults can return more than 100 results in a single call and whether than applies to enhancedFindings, findings or both.

Since this applies to the service API rather than boto3 directly I created a new issue in our cross-SDK repository: aws/aws-sdk#370. I reached out to the ECR team for clarification and will update that issue when I hear back. I'm going to close this issue but please refer to that issue for any updates going forward.