ecrscan

ecrscan is golang package to scan AWS ECR Repositories and get vulunerability information.

Requirement

• install go 1.17.x or later

Usage

Example is here:

package main

import (
	"fmt"

	"github.com/jedipunkz/ecrscan/pkg/myecr"
	log "github.com/sirupsen/logrus"
)

func main() {
	e := myecr.Ecr{}
	// define ECR Repositories to scan
	e.Repositories = [][]string{
		{"scantest", "latest"},
	}
	e.Resion = "ap-northeast-1"
	// scan and get vulunerability findings
	finding, vulFindings, _ := e.ListFindings()

	for _, f := range vulFindings {
		log.WithFields(log.Fields{
			"Name": f.Name,
		}).Info("")
		log.WithFields(log.Fields{
			"Severity": f.Severity,
		}).Info("")
		log.WithFields(log.Fields{
			"URI": f.URI,
		}).Info("")
		log.WithFields(log.Fields{
			"Description": f.Description,
		}).Info("")
	}

	// "INFORMATIONAL", "LOW", "MEDIUM", "HIGH",
	// "CRITICAL", "UNDEFINED" will be entered in k
	// ref: https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ImageScanFindings.html#ECR-Type-ImageScanFindings-findingSeverityCounts
	for k, v := range finding.FindingSeverityCounts {
		fmt.Printf("Severity:%s Counts:%d\n", k, *v)
	}

	fmt.Printf("Vulunerability Source Updated At: %s\n", *finding.VulnerabilitySourceUpdatedAt)
	fmt.Printf("Image Scan Complated At: %s\n", *finding.ImageScanCompletedAt)
}

Output:

...
<snip>
INFO[0001]                                               Name=CVE-2017-11164
INFO[0001]                                               Severity=INFORMATIONAL
INFO[0001]                                               URI="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-11164"
INFO[0001]                                               Description="In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression."
Severity:INFORMATIONAL Counts:4
Severity:MEDIUM Counts:2
Severity:LOW Counts:12
Vulunerability Source Updated At: 2021-04-20 23:07:00 +0000 UTC
Image Scan Complated At: 2021-04-23 08:07:05 +0000 UTC

License

Apache License 2.0

Author

jedipunkz 🚀