Package: ecranner
ECRannerThis is that scan the vulnerability of Docker images stored in ECR.Table of contentsFeatureGet StartedInstall PrerequirementsInstall ECRannerWrite ecranner.ymlExecuteConfiguration ParameterCommand optionsFeaturePull Docker Image From ECRSupport multi accountVulnerability ScanTrivydetects software (OS package and application library) vulnerabilities in Docker ImageSlack IntegrationPush vulnerability information to Slack. Slack UI is as following:Get StartedInstall PrerequirementsTrivyGit (Used with Trivy)Install ECRannerpip install ecrannerWrite ecranner.ymlAecranner.ymllooks like this:aws:
  stg:
    account_id: xxxxxxxxx
    region: us-east-1
    aws_access_key_id: xxxxxxxxx
    aws_secret_access_key: xxxxxxxxx
    images:
      - image:latest
      - image:1.0-dev
  prod:
    account_id: xxxxxxxxx
    region: us-east-1
    aws_access_key_id: xxxxxxxxx
    aws_secret_access_key: xxxxxxxxx
    images:
      - image:1.4
      - image:5.3

trivy:
  path: ~/user/.local/bin/trivy
  options: --severity CRITICAL -qExecuteecrannerYou execute the above and then output the scan result to the console as follows:[ { 'Target': 'image_name:latest'
              '(alpine 3.10.1)',
    'Vulnerabilities': [ { 'Description': 'aa_read_header in '
                                          'libavformat/aadec.c in FFmpeg '
                                          'before 3.2.14 and 4.x before 4.1.4 '
                                          'does not check for sscanf failure '
                                          'and consequently allows use of '
                                          'uninitialized variables.',
                           'FixedVersion': '4.1.4-r0',
                           'InstalledVersion': '4.1.3-r1',
                           'PkgName': 'ffmpeg',
                           'References': [ 'https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1.4',
                                           'https://github.com/FFmpeg/FFmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014b',
                                           'https://github.com/FFmpeg/FFmpeg/compare/a97ea53...ba11e40',
                                           'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12730',
                                           'http://www.securityfocus.com/bid/109317',
                                           'https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/9b4004c054964a49c7ba44583f4cee22486dd8f2'],
                           'Severity': 'HIGH',
                           'Title': '',
                           'VulnerabilityID': 'CVE-2019-12730'}Configuration ParameterSpecify to use parameter inecranner.yml.v1.0Command optionsoptionrequireddefaultdescription-f, --filefalse./ecranner.ymlFilepath to configuration in YAML.Specify this option if you change configuration filename.--env-filefalse./.envSpecify .env file path.Automatically load .env file if this file is found in current directory.--slackfalseN/ASend the scan result to Slack.If you use this option, set incoming webhooks url as system environment variable like this:export SLACK_WEBHOOK=https://xxxxxxxxxx--rmfalseN/ARemove images after scan with Trivy.-q, --quietfalseN/ASuppress logging message.--no-cachefalseN/AImplement in the future, so you can not use this optionDisable to store cache.This command does not use cache, but Trivy command use cache.-h, --helpfalseN/AShow command option usage.