如何通过AWS CDK激活ECR增强扫描（持续扫描）

ECR原生的ImageScanningConfigurationProperty确实不支持配置增强扫描和持续扫描，可通过以下两种方式实现需求：

方案一：使用CustomResource调用ECR API #

这是兼容性最广的方案，适用于所有支持Inspector V2的区域：

步骤1：启用Inspector V2 #

增强扫描依赖Inspector V2服务，先在栈中启用其ECR镜像扫描能力：

import * as cdk from 'aws-cdk-lib';
import * as inspector from 'aws-cdk-lib/aws-inspectorv2';
import { Construct } from 'constructs';

export class EcrEnhancedScanStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new inspector.CfnEnable(this, 'EnableInspectorV2', {
      resourceTypes: ['ECR_IMAGE']
    });
  }
}

步骤2：创建ECR仓库并配置增强扫描 #

通过CustomResource调用ECR的PutImageScanningConfiguration API，设置增强和持续扫描参数：

import * as cdk from 'aws-cdk-lib';
import * as ecr from 'aws-cdk-lib/aws-ecr';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as customresources from 'aws-cdk-lib/custom-resources';
import { Construct } from 'constructs';

export class EcrEnhancedScanStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // 启用Inspector V2
    new inspector.CfnEnable(this, 'EnableInspectorV2', {
      resourceTypes: ['ECR_IMAGE']
    });

    // 创建ECR仓库
    const repo = new ecr.Repository(this, 'MyEcrRepo', {
      repositoryName: 'my-app-repo',
      imageScanningConfiguration: {
        scanOnPush: true
      }
    });

    // 给CustomResource的Lambda角色赋予ECR配置权限
    const scanConfigRole = new iam.Role(this, 'EcrScanConfigRole', {
      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
      inlinePolicies: {
        EcrScanPolicy: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              actions: ['ecr:PutImageScanningConfiguration'],
              resources: [repo.repositoryArn]
            })
          ]
        })
      }
    });

    // 配置增强持续扫描
    new customresources.AwsCustomResource(this, 'EcrEnhancedScanConfig', {
      onUpdate: {
        service: 'ECR',
        action: 'putImageScanningConfiguration',
        parameters: {
          repositoryName: repo.repositoryName,
          imageScanningConfiguration: {
            scanOnPush: true,
            enhancedScanEnabled: true,
            continuousScanEnabled: true
          }
        },
        physicalResourceId: customresources.PhysicalResourceId.of(`EcrEnhancedScan-${repo.repositoryName}`)
      },
      role: scanConfigRole,
      installLatestAwsSdk: true
    });
  }
}

方案二：直接使用CloudFormation原生属性（部分区域支持） #

部分AWS区域的CloudFormation已更新CfnRepository的imageScanningConfiguration属性，支持直接设置增强和持续扫描参数，可尝试以下代码：

import * as cdk from 'aws-cdk-lib';
import * as ecr from 'aws-cdk-lib/aws-ecr';
import { Construct } from 'constructs';

export class EcrEnhancedScanStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new ecr.CfnRepository(this, 'MyEcrRepo', {
      repositoryName: 'my-app-repo',
      imageScanningConfiguration: {
        scanOnPush: true,
        enhancedScanEnabled: true,
        continuousScanEnabled: true
      }
    });
  }
}

若部署时报错，说明当前区域暂不支持该属性，需切换到方案一。

关键说明 #

• 增强扫描必须依赖Inspector V2，未启用会导致配置失败。
• continuousScanEnabled需搭配enhancedScanEnabled: true使用，单独设置无效。
• CustomResource的onUpdate会在栈创建、更新时触发，确保扫描配置始终生效。

内容的提问来源于stack exchange，提问作者Stefan