Description

Detects Amazon ECR repositories configured with overly permissive access policies that grant access to all AWS users ("*"). Such misconfiguration could allow unauthorized users to access, pull, or manipulate container images, potentially exposing sensitive data or enabling supply chain attacks.

Detection Strategy

• Scans each ECR repository in the specified AWS region for its resource policy

• Reports a vulnerability if the repository policy contains any statement that has Principal set to '*' or {"AWS": "*"} with Allow effect and no limiting conditions

• Ignores repositories that have no resource policy attached