We recently installed AWS inspector and it found quite a lot of CVE's in our ECR repo. We run patching regularly and I thought a tool like Inspector would be useful in find things to patch. Unfortunately most of the images in the repo are old images that are only there for archive purposes and aren't deployed anywhere. I think in this case the only thing that can be done to shorten the list of vulnerabilities is to remove the old images and so also lose the history. Also most of the vulnerabilities appear to have no available patches as of yet.
Is there a way to find only CVEs that really are an issue (images actually deployed to an EKS cluster somewhere) and have available patches? This would allow us to find only vulnerabilities that are both real and actionable. As it is, it's really time consuming sifting through a big list of vulnerabilities where 95% either aren't really a problem and/or there is nothing that can currently be done about them. Other security tools I've used in the past do this out of the box, but I can't seem to find a way in Inspector.
AWS 官方已更新 2 年前
I was thinking the same thing. Try putting your actively used images in a different repository from your archived images (ex: active-repository), and then use ECR filters to only scan your active-repository.