Configure an AWS ECR Connector to Import Images in Tenable Container Security

Required Additional License: Tenable Container Security

Required User Role: Administrator

To import and analyze images hosted in an Amazon Web Service (AWS) Elastic Container Registry (ECR), you must configure your AWS ECR connector. Tenable Container Security then imports the images from your registry and scans the images for vulnerabilities.

The amount of time Tenable Container Security takes to scan the images in your registry and display the results depends on the size and number of images you scan.

Note: If you use a connector to import and scan your images, Tenable Container Security may take up to several hours to display your images on the dashboard.

If your images do not appear on the dashboard within 24 hours of when you begin the import, contact Tenable Support.

Before you begin:

To configure a connector to an AWS Elastic Container Registry:

  1. In the Connectors section of the Container Security dashboard, click Create.

    Tenable Vulnerability Management opens the Cloud Connectors page, and the Cloud Connectors plane appears.

  2. In the Container Security section, click AWS Elastic Container Registry.
  3. In the URL box, type the fully qualified domain name of your ECR deployment (for example, https://579133718396.dkr.ecr.us-east-2.amazonaws.com).
  4. In the User Name box, type AWS.
  5. In the Password box, type the base 64-encoded password used in the docker login command generated by the AWS CLI.

    Tip: If your ECR is in the us-east-2 region, you can run the aws ecr get-login-password --region us-east-2 command to get the docker login command.

  6. Do one of the following:

    • To save the connector, click Save.

      Note: If you click Save, Tenable Container Security saves your configured connector but does not import your assets. To launch a manual import for the connector, see Launch a Connector Import Manually.

    • To save the connector and import your assets from the registry, click Save & Import.

      Note: When you import container images to scan, Tenable Container Security may abort the scan if the scan has been running for 60 minutes. If this happen, Scan Failed appears on the Images page in the Vulnerabilities and Malware columns for the aborted images.

      If Tenable Container Security aborts your scan, try simplifying your images before you import them, as described in the Docker Documentation. Alternatively, you can use the Tenable Container Security Scanner to scan your images without importing them to Tenable Container Security.

      If Tenable Container Security still aborts your scan, contact Tenable Support.

  7. (Optional) Click Back to configure another connector.

What to do next: