is there any way to filter ECR image scan findings?

Question

I have a cloudwatch event that scans ECR repository for Vulnerabilities connected to SNS topic that triggers the notification to specified end point. Here my requirement is to filter the scan findings like trigger the SNS topic only when scan finds "Critical".

{ "detail-type": [ "ECR Image Scan" ], "source": [ "aws.ecr" ], "detail": { "severity": [ "CRITICAL" ] } }

Answer 1

It works with this pattern:

{
  "source": [
    "aws.ecr"
  ],
  "detail-type": [
    "ECR Image Scan"
  ],
  "detail": {
    "finding-severity-counts": {
      "CRITICAL": [
        {
          "numeric": [
            ">",
            0
          ]
        }
      ]
    }
  }
}

Above is the Cloudwatch event pattern for filtering scan findings only on Critical count.

See https://docs.aws.amazon.com/eventbridge/latest/userguide/eventbridge-and-event-patterns.html for more details.