[ECS/ECR] [request]: Ability to lookup ECS tasks across AWS accounts running with vulnerable container images

[toricls]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request

Regarding ECR’s image scanning, we have to find which tasks are actually using the container image which got reported that it has vulns in it. It would be great if we can lookup and/or list-up the tasks (and the services which refer to them) across AWS accounts from within the ECR management console.

and/or

It’s good if it just includes “Here is a task/service list which are using this vulnerable image” in the ECR events.

Which service(s) is this request for?

ECS, ECR

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

The ECR image scanning feature can report images’ vulns for us but we have to find out by ourselves whether we have running tasks with that image, by looking around the ECS console or grepping task/service definitions in our git repositories for example. We can make the ECR’s vulns reports more actionable if it’s possible to lookup such vulnerable ECS tasks/services from the ECR management console quickly.

Are you currently working around this issue?

I have not implemented yet, but if I do that, I’d keep track of all the active container image names by recording start/stop ECS task events into DynamoDB table and/or Elasticsearch to lookup vulnerable tasks/services with a Lambda function which subscribes the ECR image scanning events.

Additional context

Attachments

[RyanFrench]

This woud be very benefical to my team, as long as this could work cross account. We curenty host ECR in one account, and our multiple ECS clusters in different accounts. I have been asked to investigate triggering scans on ECR for all images with containers running in any of our accounts and was looking to do this with a lambda, but an integrated solution would be much nicer.