Repository: turbot/steampipe-plugin-aws (language: go)

Issue:
Add support to query the `aws_ecr_image_scan_finding` table using the `image_digest` query parameter.
**Is your feature request related to a problem? Please describe.**
 I’ve recently learned that if you use AWS Native scanning in ECR, the DescribeImages API does not return image scan findings. You have to use the [DescribeImageScanFindings](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeImageScanFindings.html) API. Steampipe, unfortunately, doesn’t know about this and will instead report no vulns when querying the aws_ecr_image  table :grimacing:. Also, trying to use the aws_ecr_image_scan_finding table doesn’t work if the image isn’t tagged, i.e.

```
> select repository_name,image_tags from temporal_arc.aws_ecr_image where image_uri = '...example...'
+------------------+------------+
| repository_name  | image_tags |
+------------------+------------+
| test-repo        | <null>     |
+------------------+------------+

```

**Describe the solution you'd like**
The CLI allows for queries by digest, is that possible to do in Steampipe?

```
❯ aws ecr describe-image-scan-findings --repository-name "test-repo" --image-id imageDigest=sha256:f9656f8fde6685bae8c7cd02c24b4d11f46e11764bdc149a25313f8ba19e356c
{
    "imageScanFindings": {
        "findings": [ ...snip...
```

**Describe alternatives you've considered**
N/A

**Additional context**
N/A



Discussion / hints:

Fix patch:
diff --git a/aws/table_aws_ecr_image_scan_finding.go b/aws/table_aws_ecr_image_scan_finding.go
index 5fa1ee198..7188ef6b7 100644
--- a/aws/table_aws_ecr_image_scan_finding.go
+++ b/aws/table_aws_ecr_image_scan_finding.go
@@ -33,7 +33,8 @@ func tableAwsEcrImageScanFinding(_ context.Context) *plugin.Table {
 			// image_digest as it's more common/friendly to use.
 			KeyColumns: []*plugin.KeyColumn{
 				{Name: "repository_name", Require: plugin.Required},
-				{Name: "image_tag", Require: plugin.Required},
+				{Name: "image_tag", Require: plugin.AnyOf},
+				{Name: "image_digest", Require: plugin.AnyOf},
 			},
 		},
 		GetMatrixItemFunc: SupportedRegionMatrix(ecrv1.EndpointsID),
@@ -125,8 +126,8 @@ func listAwsEcrImageScanFindings(ctx context.Context, d *plugin.QueryData, _ *pl
 	}
 
 	imageTag := d.EqualsQuals["image_tag"]
+	imageDigest := d.EqualsQuals["image_digest"]
 	repositoryName := d.EqualsQuals["repository_name"]
-	
 
 	// Limiting the results
 	maxLimit := int32(1000)
@@ -140,11 +141,27 @@ func listAwsEcrImageScanFindings(ctx context.Context, d *plugin.QueryData, _ *pl
 	input := &ecr.DescribeImageScanFindingsInput{
 		MaxResults:     aws.Int32(maxLimit),
 		RepositoryName: aws.String(repositoryName.GetStringValue()),
-		ImageId: &types.ImageIdentifier{
-			ImageTag: aws.String(imageTag.GetStringValue()),
-		},
 	}
 
+	imageInfo := &types.ImageIdentifier{}
+
+	// Ideally, both image_tag and image_digest could be used.
+	// However, they cannot be passed together simultaneously.
+	// 1. If ImageTag is provided, it takes precedence and is used as the input parameter.
+	// 2. If both ImageTag and ImageDigest are provided, ImageTag will be prioritized to keep the existing table behavior unchanged.
+	// 3. If only ImageDigest is provided, the ImageDigest value will be used as the input parameter.
+	if imageTag != nil {
+		imageInfo.ImageTag = aws.String(imageTag.GetStringValue())
+	}
+	if imageTag != nil && imageDigest != nil {
+		imageInfo.ImageTag = aws.String(imageTag.GetStringValue())
+	}
+	if imageTag == nil && imageDigest != nil {
+		imageInfo.ImageDigest = aws.String(imageDigest.GetStringValue())
+	}
+
+	input.ImageId = imageInfo
+
 	paginator := ecr.NewDescribeImageScanFindingsPaginator(svc, input, func(o *ecr.DescribeImageScanFindingsPaginatorOptions) {
 		o.Limit = maxLimit
 		o.StopOnDuplicateToken = true


Test patch: