Container images residing in Amazon ECR repositories that are configured for continual scanning are scanned for the duration configured in the Amazon Inspector console or APIs. Available rescan duration configurations for image push date are 90 days (by default), 14 days, 30 days, 60 days, 180 days, or lifetime. The rescan duration configurations for image pull date are 90 days (by default), 14 days, 30 days, 60 days, or 180 days.
When Amazon Inspector ECR scanning is activated, Amazon Inspector only picks up images pushed or pulled in last 30 days for scanning, but continually scans them for the rescan duration configured for push and pull date. i.e, 90 days (by default), 14 days, 30 days, 60 days, 180 days, or lifetime. If the push date of an image is less than the configured “Push date rescan duration” AND image has been pulled within the configured “Pull date rescan duration”, the container image will continue to be monitored and automated rescans are started when a new CVE affecting an image is published. For example, when activating Amazon Inspector ECR scanning, Amazon Inspector will pick up images pushed or pulled in the last 30 days for scanning. However post-activation, if you select 180 days rescan duration for both push date and pull date configurations, Amazon Inspector will continue to scan the images if they were pushed in the last 180 days or have been pulled at least once in the last 180 days. If an image hasn’t been push or pulled in the last 180 days, Amazon Inspector will stop monitoring it.
All images pushed to ECR after Amazon Inspector ECR scanning is activated are continually scanned for the duration configured in “Push date rescan duration” and “Pull date rescan duration”. Available rescan duration configurations for image push date are 90 days (by default), 14 days, 30 days, 60 days, 180 days, or lifetime. The rescan duration configurations for image pull date are 90 days (by default), 14 days, 30 days, 60 days, or 180 days. The automated re-scan duration is calculated based on last push or pull date of a container image. For example, after activating Amazon Inspector ECR scanning, if you select 180 days rescan duration for both push data and pull date configurations, Amazon Inspector will continue to scan the images if they were pushed in the last 180 days or have been pulled at least once in the last 180 days. However, if an image hasn’t been pushed or pulled in the last 180 days, Amazon Inspector will stop monitoring it.
If the image is in “scan eligibility expired” state, you can pull the image to bring it back under Amazon Inspector monitoring. The image will be continually scanned for the push and pull date rescan durations configured from the last pulled date.