ECR Repositories Should Be Private

More Info:

ECR repository policies should not enable global or public access to images. ECR repository policies should limit access to images to known IAM entities and AWS accounts and avoid the use of account-level wildcards.

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• HIPAA
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of ECR repositories not being private in AWS:

1. Login to your AWS console.
2. Navigate to the Amazon Elastic Container Registry (ECR) service.
3. Select the repository that you want to make private.
4. Click on the “Permissions” tab.
5. Under the “Repository policy” section, click on the “Edit” button.
6. In the JSON editor, replace the existing policy with the following policy:

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AccessDenied",
      "Effect": "Deny",
      "Principal": "*",
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ]
    },
    {
      "Sid": "AllowPushPull",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AWS_ACCOUNT_ID:root"
      },
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload"
      ]
    }
  ]
}

Note: Replace “AWS_ACCOUNT_ID” with your AWS account ID.

7. Click on the “Save” button to save the policy.
8. Verify that the repository is now private by checking the “Repository visibility” under the “Overview” tab.

That’s it! You have successfully remediated the misconfiguration of ECR repositories not being private in AWS.

Using CLI

To remediate the misconfiguration of ECR repositories being public, you can follow the below steps using AWS CLI:

1. Open the AWS CLI and run the following command to list all ECR repositories in your account:

   aws ecr describe-repositories
   

2. For each repository that is public, run the following command to modify its permissions:

   aws ecr set-repository-policy --repository-name <repository-name> --policy-text '{"Version": "2008-10-17", "Statement": [{"Sid": "DenyPublicPull", "Effect": "Deny", "Principal": "*", "Action": ["ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken", "ecr:DescribeRepositories", "ecr:ListImages"], "Condition": {"Bool": {"aws:SecureTransport": "false"}}}]}' 
   

   Replace <repository-name> with the name of the repository that you want to make private.

3. Verify that the repository is now private by running the following command:

   aws ecr describe-repositories --repository-names <repository-name>
   

   The output should include "repositoryPolicyText": "{\"Version\": \"2008-10-17\", \"Statement\": [{\"Sid\": \"DenyPublicPull\", \"Effect\": \"Deny\", \"Principal\": \"*\", \"Action\": [\"ecr:BatchGetImage\", \"ecr:GetDownloadUrlForLayer\", \"ecr:GetAuthorizationToken\", \"ecr:DescribeRepositories\", \"ecr:ListImages\"], \"Condition\": {\"Bool\": {\"aws:SecureTransport\": \"false\"}}}]}"

4. Repeat the above steps for all ECR repositories that are public in your account.

By following these steps, you can remediate the misconfiguration of ECR repositories being public and make them private.

Using Python

To remediate the misconfiguration “ECR Repositories Should Be Private” for AWS using python, you can follow these steps:

1. Import the necessary AWS SDK and Boto3 library in your python code.

import boto3

2. Create a Boto3 ECR client object to interact with ECR.

ecr_client = boto3.client('ecr')

3. Get a list of all the ECR repositories in your AWS account using the describe_repositories method.

response = ecr_client.describe_repositories()
repositories = response['repositories']

4. For each repository, check if it is public or not using the describe_images method. If the repository is public, update its permissions to make it private using the set_repository_policy method.

for repo in repositories:
    response = ecr_client.describe_images(repositoryName=repo['repositoryName'])
    if 'imageDetails' in response and len(response['imageDetails']) > 0:
        image_detail = response['imageDetails'][0]
        if 'imageTags' in image_detail and len(image_detail['imageTags']) > 0:
            image_tag = image_detail['imageTags'][0]
            policy_text = '{"Version": "2008-10-17","Statement": [{"Sid": "AllowPushPull","Effect": "Allow","Principal": {"AWS": "*"},"Action": ["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"]},{"Sid": "DenyAll","Effect": "Deny","Principal": {"AWS": "*"},"Action": "ecr:*"}]}'
            ecr_client.set_repository_policy(repositoryName=repo['repositoryName'], policyText=policy_text)

5. Once the permissions have been updated, print a message to confirm that the repositories have been made private.

print("All ECR repositories have been made private.")

This code will remediate the misconfiguration “ECR Repositories Should Be Private” for AWS using python.

Using Terraform

# ECR repository used by your Kubernetes workloads
resource "aws_ecr_repository" "k8s_app" {
  name = "K8S_ECR_REPOSITORY_NAME" # e.g. "k8s-app"
}

# IMPORTANT:
# To make the repository private (IAM-only) and match the CLI remediation,
# REMOVE any aws_ecr_repository_policy resource that applies to this repository.
#
# For example, if you currently have something like this:
#
# resource "aws_ecr_repository_policy" "k8s_app_public" {
#   repository = aws_ecr_repository.k8s_app.name
#   policy     = data.aws_iam_policy_document.ecr_public.json
# }
#
# delete that resource block from your Terraform configuration.

Removing the aws_ecr_repository_policy resource does not replace the ECR repository itself; it only deletes the policy so access is governed solely by IAM permissions, matching aws ecr delete-repository-policy.

After updating the code, terraform plan should show the aws_ecr_repository_policy resource for this repository with - (destroy) and no changes to aws_ecr_repository.

Additional Reading:

• https://docs.aws.amazon.com/AmazonECR/latest/userguide/RepositoryPolicyExamples.html