Container image scanning with Dockle in AWS CDK
Tags: aws, cdk, docker, dockle
Published: 2023-09-11 11:22:55

## Overview

A Construct for AWS CDK, which uses **Dockle** to perform security diagnostics on **container images**, is published on Construct Hub.

---

## Dockle

[Dockle](https://github.com/goodwithtech/dockle) is a container image vulnerability inspection and diagnostic tool that warns and suggests remedies for vulnerabilities in an image built from a Dockerfile.

---

## Advantages for this Construct

This Construct can do the following

- Scan container images with Dockle **in the CDK layer (in `cdk deploy`)**.
- Avoid unnecessary builds and **use assets from images built in CDK deploy**.
- **Stop application image push to ECR** when vulnerabilities are detected.

---

## image-scanner-with-dockle

The Construct I created this time has been published on Construct Hub under the name ["image-scanner-with-dockle"](https://constructs.dev/packages/image-scanner-with-dockle).

In addition, it is necessary to publish to npm in advance for Construct Hub publication, and the page as an npm package is shown below, see [this page](https://www.npmjs.com/package/image-scanner-with-dockle).

And while you're at it, take a look at [GitHub](https://github.com/go-to-k/image-scanner-with-dockle) if you like.

---

## How to use

### Install

First, install in the CDK repository.

```sh
npm install image-scanner-with-dockle
```

### Use Construct

`new ImageScannerWithDockle` is the corresponding Construct.

```typescript
    this.repository = new Repository(this, "ImageRepository", {
      removalPolicy: RemovalPolicy.DESTROY,
      autoDeleteImages: true,
    });

    const image = new DockerImageAsset(this, "DockerImage", {
      directory: resolve(__dirname, "../../.."),
    });

    const imageScannerWithDockle = new ImageScannerWithDockle(this, "ImageScannerWithDockle", {
      imageUri: image.imageUri,
      repository: image.repository,
      ignore: ["CIS-DI-0009"],
    });

    // By adding addDependency, if the vulnerabilities are detected by ImageScannerWithDockle, the following ECRDeployment will not be executed, deployment will fail.
    const ecrDeployment = new ECRDeployment(this, "DeployImage", {
      src: new DockerImageName(image.imageUri),
      dest: new DockerImageName(`${this.repository.repositoryUri}:${props.ecrTag}`),
    });
    ecrDeployment.node.addDependency(imageScannerWithDockle);
```

### Stop image push on vulnerability detection

As shown in the example above, `ecrDeployment.node.addDependency(imageScannerWithDockle)` will make `ECRDeployment` depends on `ImageScannerWithDockle` so that `ImageScannerWithDockle` is executed first. `ImageScannerWithDockle` will **stop pushing images to the application ECR** if it detects a vulnerability.

### ignore

Rules you want to ignore can be specified in the `ignore` parameter. If nothing is to be ignored, the `ignore` parameter can be omitted.

```typescript
    const imageScannerWithDockle = new ImageScannerWithDockle(this, "ImageScannerWithDockle", {
      imageUri: image.imageUri,
      repository: image.repository,
      ignore: ["CIS-DI-0002", "CIS-DI-0003"],
    });
```

See [the page](https://github.com/goodwithtech/dockle#checkpoint-summary) for the types of ignore rules.

### SingletonFunction

This construct uses **a custom resource Lambda** in AWS CDK.

You will create (call) `ImageScannerWithDockle` **many times** when building **multiple images** in one stack, and it would be **a waste** to generate several Lambda functions with the same code each time.

Here, this Construct uses a Construct called [SingletonFunction](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.SingletonFunction.html) to generate and use **only one Lambda** so that **the same Lambda** can be used inside the AWS CDK **no matter how many times it is called**.

An example of actual use, in source code, is [here](https://github.com/go-to-k/image-scanner-with-dockle/blob/v1.0.9/src/index.ts#L41-L50).

---

## Trivy version

I used `Dockle` for this project, but I have also published [a library that uses Trivy](https://dev.to/aws-builders/container-image-scanning-with-trivy-in-aws-cdk-151h), if you would like to use it!

---

## Finally

I made this because there was a case where I wanted to perform image scanning by Dockle in an environment that fully utilizes AWS CDK.