Skip to main content

SBOM for AWS ECR

Gain visibility into the container images stored in your Amazon Elastic Container Registry (ECR) and the software packages they include. The SBOM for AWS ECR integration assumes an IAM role in your AWS account, discovers repositories by tag, and scans your most recent images for software components and known vulnerabilities, enabling you to query, monitor, and alert on changes in your software supply chain.

Installation​

For this integration, you will need an AWS account with one or more images stored in Amazon Elastic Container Registry (ECR), and an IAM role that JupiterOne can assume to read from your registry. The integration authenticates by assuming this role with an auto-generated External ID, discovers repositories by tag, and scans the most recent images in each matching repository for SBOM (Software Bill of Materials) ingestion.

Set permissions in AWS​

Create an IAM role in the AWS account that hosts your ECR registry, and configure its trust policy to allow JupiterOne to assume it using the External ID that is auto-generated when you create the integration instance (see below). Attach a policy granting the following read-only Amazon ECR permissions:

  • ecr:GetAuthorizationToken
  • ecr:DescribeRepositories
  • ecr:ListTagsForResource
  • ecr:DescribeImages
  • ecr:BatchCheckLayerAvailability
  • ecr:GetDownloadUrlForLayer
  • ecr:BatchGetImage

ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage allow the integration to authenticate to the registry and pull image layers for scanning. ecr:DescribeRepositories and ecr:ListTagsForResource are used to discover repositories by tag, and ecr:DescribeImages to select the most recent images per repository.

Configuration in JupiterOne​

To install the SBOM for AWS ECR integration in JupiterOne, navigate to the Integrations tab and select SBOM for AWS ECR. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • Registry – The URL of your ECR registry, such as <account-id>.dkr.ecr.<region>.amazonaws.com for a private registry or public.ecr.aws/<namespace> for a public registry.
  • Role ARN – The ARN of the IAM role JupiterOne assumes to authenticate with AWS.
  • External ID – Auto-generated by JupiterOne. Use this value when configuring the trust policy of the IAM role. You may change it, but doing so is against Amazon's security recommendations.
  • Region – (Optional) The AWS region where the registry is located. Defaults to us-east-1.

Data filters​

  • Tag – Filter which repositories to ingest SBOMs from using AWS resource tags. Use the format tag-key:tag-value (for example, environment:production), or specify only the tag key to match any value (for example, environment). Only repositories carrying a matching tag are processed.
  • Images to Scan – The number of most recent images to scan per repository (1, 2, or 3). Defaults to 1.

If your registry is served behind an internal or self-signed certificate, you can optionally provide a Certificate Authority Certificate (PEM format, full CA chain) under TLS / Certificate Settings to verify the TLS connection to the registry.

Click Create once all required values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.