Explore the Vulnerabilities in ECR

[KazushiR]

Dependency

Overview

We need to identify security vulnerabilities in our EC2 instances, so that we can create issues to resolve and provide a safe environment for our project's data.

Details

As an Ops member, I'd like to know what type of security vulnerabilities are in place currently within the infrastructure of OPS. I would like to go into the ECR and go to each instance to find the most critical vulnerabilities are currently in place. Write a report on this about each vulnerability and see if there is any way we can mitigate anything.

Action Items

• Go into the ECR instance
• Look at each CVE vulnerabilities
• Document in a Google Doc each vulnerability

Resources/Instructions

• Document: ECR vulnerabilities
• Wikis
  • https://github.com/hackforla/incubator/wiki/AWS-Resources
  • https://github.com/hackforla/ops/wiki

[ExperimentsInHonesty]

@RSkuma
Please provide update

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures or links* (if necessary): "Add any pictures or links that will help illustrate what you are working on."

• remember to add links to the top of the issue if they are going to be needed again.

[ale210]

I think that the original intent was for the author to go into ecr and manually catalog scanning results and place them into a document. It's also not clear if this can be done, as many containers run on alpine linux which is not accessible to the default scanning that ECR uses. It's also not clear if this is referencing ECR or EC2.

If the intent was to go in and catalog something in ECR, I think that it is better to go with some kind of automated scanning as part of GHA. Going to close this issue