Amazon ECR Integration

Connect your AWS Elastic Container Registry (ECR) to Safeguard for container image SBOM generation and vulnerability scanning.

Prerequisites

• An AWS account with ECR repositories
• AWS Access Key ID and Secret Access Key with ECR permissions

Public ECR Images

Amazon ECR Public Gallery images can be scanned without authentication.

Step 1: Navigate to Integrations

Go to Integrations from the sidebar and click Connect on the Amazon ECR card.

Step 2: Enter Image Reference

1. Select the Public tab
2. Enter a Name for this configuration
3. Optionally add a Description
4. Enter the ECR Public image URI (e.g., public.ecr.aws/nginx/nginx:latest)
5. Click Add

Step 3: Review & Connect

1. Configure Project Name and Version
2. Click Connect to complete

Private ECR Images

Step 1: Navigate to Integrations

Go to Integrations from the sidebar and click Connect on the Amazon ECR card.

Step 2: Enter AWS Credentials

1. Select the Private tab
2. Enter a Name for this configuration
3. Optionally add a Description
4. Enter your AWS credentials:
   • AWS Access Key ID
   • AWS Secret Access Key
   • AWS Region (e.g., us-east-1)
5. Click Verify Credentials

Step 3: Select Images

1. Once verified, browse available repositories
2. Select the images you want to scan
3. Choose specific tags or digests

Step 4: Configure & Connect

1. Set Project Name and Version for each image
2. Click Connect to complete

Creating AWS Credentials

Option 1: IAM User with Access Keys

1. Go to AWS Console then IAM then Users
2. Click Add users
3. Enter a username (e.g., "safeguard-ecr-readonly")
4. Select Access key - Programmatic access
5. Click Next: Permissions
6. Attach the AmazonEC2ContainerRegistryReadOnly policy
7. Click Create user
8. Copy the Access Key ID and Secret Access Key

Option 2: Custom IAM Policy

Create a custom policy with minimum required permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecr:DescribeImages"
      ],
      "Resource": "*"
    }
  ]
}

Required IAM Permissions

Troubleshooting

"Credentials verification failed"

• Verify the Access Key ID and Secret are correct
• Check that the IAM user has the required permissions
• Ensure the credentials haven't been deactivated

"Repository not found"

• Verify the region is correct
• Check that the IAM user has access to that repository
• Ensure the repository exists in the specified region

"Access denied"

• The IAM policy may be missing required permissions
• Check for any SCPs (Service Control Policies) that might restrict access
• Verify the repository policy allows access