Merge pull request #5 from centriascolocation/feature/2-ecr-scan-on-push

scan all ECRs for scan-on-push

README.md

@@ -34,6 +34,7 @@ Batteries included:
     * all your S3 Buckets are not public and encrypted (per Region) :white_check_mark:
     * Organizations :white_check_mark:
     * all your EBS volumes should be encrypted (per region) :white_check_mark:
+    * ECR: Test that images are scanned for vulnerabilities at a push to repository
 
 ## Usage
 

controls/99-ecr.rb

@@ -0,0 +1,12 @@
+title '99 ECR Scan On Push'
+
+control 'ecr-repositories-99.3' do
+  title 'ECR scan on push is activated'
+  desc 'Test that images are scanned for vulnerabilities at a push to repository'
+
+  aws_ecr_repositories.names.each do |repository_name|
+    describe aws_ecr_repository(repository_name) do
+      its('image_scanning_configuration.scan_on_push') { should eq true }
+    end
+  end
+end