From d3447dde5d34b06871e8a5631ceee5527d5cc7ab Mon Sep 17 00:00:00 2001 From: Sam Vader Date: Wed, 14 Oct 2026 15:53:27 -0500 Subject: [PATCH 1/7] docs(connectors): Security Hub ECR images in use only Documents the ECR Images in Use Only toggle of the Security Hub connector, its Amazon Inspector permission and its limits. Names the form section Import Configuration, as the form shows it. --- .../connectors/toolreference/security_hub.md | 36 ++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-) diff --git a/docs/content/connectors/toolreference/security_hub.md b/docs/content/connectors/toolreference/security_hub.md index 9aa1dbf6697..ad8b981b7c0 100644 --- a/docs/content/connectors/toolreference/security_hub.md +++ b/docs/content/connectors/toolreference/security_hub.md @@ -54,7 +54,7 @@ DefectDojo can pull Findings from more than one region using Security Hub's **cr #### Asset Grouping (optional) -By default the connector creates one Record, and so one asset, per AWS account and region, named `Account ()`. Every finding in that account and region lands on that one asset, whatever resource it is about. The **Asset Grouping** field, under **Import Filters** on the connector form, can split findings more finely: +By default the connector creates one Record, and so one asset, per AWS account and region, named `Account ()`. Every finding in that account and region lands on that one asset, whatever resource it is about. The **Asset Grouping** field, under **Import Configuration** on the connector form, can split findings more finely: | Asset Grouping | Records | Findings are imported on | |---|---|---| @@ -90,6 +90,25 @@ Turn on **Parent Asset per AWS Account** to add one asset per AWS account above Existing account and region assets keep their names and identities, so existing mappings, findings and history are unchanged; they gain the parent on the next discovery. The account asset is placed in the same organization as the account's other assets (see *Organization Placement*). Turning the toggle off stops creating account assets; relationships already drawn stay until you remove them. +#### ECR Images in Use Only (optional) + +Amazon Inspector reports the vulnerable packages of the images that it monitors in ECR. It also reports images that nothing runs. Turn on **ECR Images in Use Only** to skip the findings of ECR images that do not run. The toggle is under **Import Configuration** on the connector form. + +If the toggle is on, the connector checks each finding on an ECR container image. It imports the finding only if Amazon Inspector reports the image in an ECS task or an EKS pod. The connector asks Inspector at each Sync. + +* The connector imports findings on every other resource as before. This includes the ECR repository's own findings. +* Amazon Inspector updates the in-use data once a day. For a new image, the data can take up to 36 hours to show. +* Amazon Inspector supplies in-use data only for ECR repositories that use continuous scanning. +* At the next Sync, DefectDojo closes the imported findings of images that do not run. If an image runs again, its findings reopen at a later Sync. +* A scheduled job can run for a short time only. Its image findings can then open and close between Syncs. +* Under the **Resource** grouping, some ECR repositories do not become a Record. This applies to a repository with no running image and no finding of its own. +* Security Hub does not show which images run. The connector reads this from Amazon Inspector with `inspector2:ListCoverage`. It reads once per account and region for each Record that it syncs. Under a finer grouping, discovery also reads once per account and region. +* For member accounts, the access key must belong to the Amazon Inspector delegated administrator account in each region. +* If the permission is missing, the Sync of each Record with image findings fails. Under a finer grouping, discovery also fails. The findings stay as they were. +* If Inspector shows no images for an account and region with image findings, the connector skips that Record. Its findings stay as they were, and the connector logs a warning. Discovery leaves out the image findings of that account and region. +* The connector never imports every image as a fallback. +* The connector still reads every finding from Security Hub. A Sync takes about as long as before. Only the number of imported findings goes down. + #### Organization Placement (optional) New assets from a Security Hub connection are placed in the organization named **Security Hub Connector**. The **Organization Placement** field can instead place each AWS account's assets in an organization of its own: @@ -191,6 +210,21 @@ With the **Resource** grouping, each ECR repository asset gets the repository's The permission is optional. Without it, or for a repository in an account these credentials cannot read, the connector makes one refused request per account, logs the first, and leaves those repositories with only the tags their findings carry. When a lookup fails for another reason, the repository asset keeps the tags it already has until the next discovery; if Amazon ECR cannot be reached at all, or five lookups in a row fail, the remaining repositories are left the same way for that discovery. The connector makes one request per discovered repository on each discovery, paced at ten per second, so a discovery across 2,000 repositories takes about three minutes longer. The other groupings make no ECR request. +#### Optional permissions: Amazon Inspector + +**ECR Images in Use Only** needs `inspector2:ListCoverage`: + +``` +{ + "Sid": "AWSSecurityHubConnectorInspector", + "Effect": "Allow", + "Action": [ + "inspector2:ListCoverage" + ], + "Resource": "*" +} +``` + #### Compliance Tags Each Finding is tagged with the compliance requirements Security Hub relates its control to, for From 3a39f74853ac77b3e299dbf91aa2bac040b01d35 Mon Sep 17 00:00:00 2001 From: Sam Vader Date: Fri, 16 Oct 2026 14:41:01 -0500 Subject: [PATCH 2/7] docs(connectors): Security Hub ECR in-use Sync cost and scan on push --- docs/content/connectors/toolreference/security_hub.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/content/connectors/toolreference/security_hub.md b/docs/content/connectors/toolreference/security_hub.md index ad8b981b7c0..5ab02abbb35 100644 --- a/docs/content/connectors/toolreference/security_hub.md +++ b/docs/content/connectors/toolreference/security_hub.md @@ -98,7 +98,7 @@ If the toggle is on, the connector checks each finding on an ECR container image * The connector imports findings on every other resource as before. This includes the ECR repository's own findings. * Amazon Inspector updates the in-use data once a day. For a new image, the data can take up to 36 hours to show. -* Amazon Inspector supplies in-use data only for ECR repositories that use continuous scanning. +* Amazon Inspector supplies in-use data only for ECR repositories that use continuous scanning. If a repository uses scan on push, the next Sync closes its image findings, even if the image runs. * At the next Sync, DefectDojo closes the imported findings of images that do not run. If an image runs again, its findings reopen at a later Sync. * A scheduled job can run for a short time only. Its image findings can then open and close between Syncs. * Under the **Resource** grouping, some ECR repositories do not become a Record. This applies to a repository with no running image and no finding of its own. @@ -107,7 +107,7 @@ If the toggle is on, the connector checks each finding on an ECR container image * If the permission is missing, the Sync of each Record with image findings fails. Under a finer grouping, discovery also fails. The findings stay as they were. * If Inspector shows no images for an account and region with image findings, the connector skips that Record. Its findings stay as they were, and the connector logs a warning. Discovery leaves out the image findings of that account and region. * The connector never imports every image as a fallback. -* The connector still reads every finding from Security Hub. A Sync takes about as long as before. Only the number of imported findings goes down. +* The connector still reads every finding from Security Hub. That part of a Sync takes as long as before. Each Record with image findings adds at least one Amazon Inspector request. Under the **Resource** grouping, that means about one request per ECR repository Record. Only the number of imported findings goes down. #### Organization Placement (optional) From d39f9b07c91104a1f4a1559d7a09b06031611548 Mon Sep 17 00:00:00 2001 From: Sam Vader Date: Fri, 16 Oct 2026 18:37:26 -0500 Subject: [PATCH 3/7] docs(connectors): Security Hub ECR in-use limits, save check and skip scope --- docs/content/connectors/toolreference/security_hub.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/content/connectors/toolreference/security_hub.md b/docs/content/connectors/toolreference/security_hub.md index 5ab02abbb35..eb499b02f7c 100644 --- a/docs/content/connectors/toolreference/security_hub.md +++ b/docs/content/connectors/toolreference/security_hub.md @@ -97,15 +97,16 @@ Amazon Inspector reports the vulnerable packages of the images that it monitors If the toggle is on, the connector checks each finding on an ECR container image. It imports the finding only if Amazon Inspector reports the image in an ECS task or an EKS pod. The connector asks Inspector at each Sync. * The connector imports findings on every other resource as before. This includes the ECR repository's own findings. +* Only Amazon ECS tasks and Amazon EKS pods count, also on AWS Fargate. An image that runs anywhere else counts as not running. This includes AWS Lambda, AWS App Runner, Docker on EC2 and self-managed Kubernetes. * Amazon Inspector updates the in-use data once a day. For a new image, the data can take up to 36 hours to show. * Amazon Inspector supplies in-use data only for ECR repositories that use continuous scanning. If a repository uses scan on push, the next Sync closes its image findings, even if the image runs. * At the next Sync, DefectDojo closes the imported findings of images that do not run. If an image runs again, its findings reopen at a later Sync. * A scheduled job can run for a short time only. Its image findings can then open and close between Syncs. * Under the **Resource** grouping, some ECR repositories do not become a Record. This applies to a repository with no running image and no finding of its own. -* Security Hub does not show which images run. The connector reads this from Amazon Inspector with `inspector2:ListCoverage`. It reads once per account and region for each Record that it syncs. Under a finer grouping, discovery also reads once per account and region. +* Security Hub does not show which images run. The connector reads this from Amazon Inspector with `inspector2:ListCoverage`. It reads once per account and region for each Record that it syncs. For an ECR repository Record, it reads only that repository. Under a finer grouping, discovery also reads once per account and region. * For member accounts, the access key must belong to the Amazon Inspector delegated administrator account in each region. -* If the permission is missing, the Sync of each Record with image findings fails. Under a finer grouping, discovery also fails. The findings stay as they were. -* If Inspector shows no images for an account and region with image findings, the connector skips that Record. Its findings stay as they were, and the connector logs a warning. Discovery leaves out the image findings of that account and region. +* If the toggle is on, saving the connection checks the `inspector2:ListCoverage` permission. If the permission goes missing later, the Sync of each Record with image findings fails. Under a finer grouping, discovery also fails. The findings stay as they were. +* If Inspector shows no images for an account and region, the connector skips its Records with image findings. The findings of a skipped Record stay as they were, and the connector logs a warning. The skip covers all findings of the Record, not only image findings. Under the default grouping, the EC2, IAM and AWS Config findings of that account and region also stop syncing. This lasts until Inspector can see the account. Under the **Resource Type** grouping, only the ECR repository Record skips. Under the **Resource** grouping, the connector asks Inspector about each ECR repository on its own. If Inspector shows no image for a repository, only the Record of that repository skips. Discovery leaves out the image findings of an account and region that Inspector cannot see. * The connector never imports every image as a fallback. * The connector still reads every finding from Security Hub. That part of a Sync takes as long as before. Each Record with image findings adds at least one Amazon Inspector request. Under the **Resource** grouping, that means about one request per ECR repository Record. Only the number of imported findings goes down. From 14cd7201f04c0aca4be016659889cc6be14abff7 Mon Sep 17 00:00:00 2001 From: Sam Vader Date: Sat, 17 Oct 2026 16:34:14 -0500 Subject: [PATCH 4/7] docs(connectors): Security Hub ECR in-use source link, scanning per region and multi-arch images --- docs/content/connectors/toolreference/security_hub.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/content/connectors/toolreference/security_hub.md b/docs/content/connectors/toolreference/security_hub.md index eb499b02f7c..306194a1141 100644 --- a/docs/content/connectors/toolreference/security_hub.md +++ b/docs/content/connectors/toolreference/security_hub.md @@ -98,15 +98,16 @@ If the toggle is on, the connector checks each finding on an ECR container image * The connector imports findings on every other resource as before. This includes the ECR repository's own findings. * Only Amazon ECS tasks and Amazon EKS pods count, also on AWS Fargate. An image that runs anywhere else counts as not running. This includes AWS Lambda, AWS App Runner, Docker on EC2 and self-managed Kubernetes. -* Amazon Inspector updates the in-use data once a day. For a new image, the data can take up to 36 hours to show. -* Amazon Inspector supplies in-use data only for ECR repositories that use continuous scanning. If a repository uses scan on push, the next Sync closes its image findings, even if the image runs. +* Amazon Inspector updates the in-use data once a day. For a new image, the data can take up to 36 hours to show. See [Mapping container images to running containers](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html#ecr-mapping-container-images) in the Amazon Inspector documentation. +* Amazon Inspector ECR scanning must be on in every region that you sync. Amazon Inspector supplies in-use data only for ECR repositories that use continuous scanning. If a repository uses scan on push, the next Sync closes its image findings, even if the image runs. +* Amazon Inspector does not support last-in-use tracking for multi-architecture images. Before you rely on the toggle for such an image, check that Amazon Inspector shows it as in use. * At the next Sync, DefectDojo closes the imported findings of images that do not run. If an image runs again, its findings reopen at a later Sync. * A scheduled job can run for a short time only. Its image findings can then open and close between Syncs. * Under the **Resource** grouping, some ECR repositories do not become a Record. This applies to a repository with no running image and no finding of its own. * Security Hub does not show which images run. The connector reads this from Amazon Inspector with `inspector2:ListCoverage`. It reads once per account and region for each Record that it syncs. For an ECR repository Record, it reads only that repository. Under a finer grouping, discovery also reads once per account and region. * For member accounts, the access key must belong to the Amazon Inspector delegated administrator account in each region. * If the toggle is on, saving the connection checks the `inspector2:ListCoverage` permission. If the permission goes missing later, the Sync of each Record with image findings fails. Under a finer grouping, discovery also fails. The findings stay as they were. -* If Inspector shows no images for an account and region, the connector skips its Records with image findings. The findings of a skipped Record stay as they were, and the connector logs a warning. The skip covers all findings of the Record, not only image findings. Under the default grouping, the EC2, IAM and AWS Config findings of that account and region also stop syncing. This lasts until Inspector can see the account. Under the **Resource Type** grouping, only the ECR repository Record skips. Under the **Resource** grouping, the connector asks Inspector about each ECR repository on its own. If Inspector shows no image for a repository, only the Record of that repository skips. Discovery leaves out the image findings of an account and region that Inspector cannot see. +* If Inspector covers no images at all for an account and region, the connector skips its Records with image findings. This happens when ECR scanning is off in that region. It also happens when the access key is not the delegated administrator for a member account. The findings of a skipped Record stay as they were, and the connector logs a warning. The skip covers all findings of the Record, not only image findings. Under the default grouping, the EC2, IAM and AWS Config findings of that account and region also stop syncing. This lasts until Inspector can see the account. Under the **Resource Type** grouping, only the ECR repository Record skips. Under the **Resource** grouping, the connector asks Inspector about each ECR repository on its own. If Inspector covers no image for a repository, only the Record of that repository skips. Discovery leaves out the image findings of an account and region that Inspector cannot see. * The connector never imports every image as a fallback. * The connector still reads every finding from Security Hub. That part of a Sync takes as long as before. Each Record with image findings adds at least one Amazon Inspector request. Under the **Resource** grouping, that means about one request per ECR repository Record. Only the number of imported findings goes down. From 77641fea19593a23fe631207da5be7865b5b44f1 Mon Sep 17 00:00:00 2001 From: Sam Vader Date: Sat, 17 Oct 2026 18:36:03 -0500 Subject: [PATCH 5/7] docs(connectors): Security Hub ECR in-use reads Inspector at least once per Record --- docs/content/connectors/toolreference/security_hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/content/connectors/toolreference/security_hub.md b/docs/content/connectors/toolreference/security_hub.md index 306194a1141..fd629f690d7 100644 --- a/docs/content/connectors/toolreference/security_hub.md +++ b/docs/content/connectors/toolreference/security_hub.md @@ -104,7 +104,7 @@ If the toggle is on, the connector checks each finding on an ECR container image * At the next Sync, DefectDojo closes the imported findings of images that do not run. If an image runs again, its findings reopen at a later Sync. * A scheduled job can run for a short time only. Its image findings can then open and close between Syncs. * Under the **Resource** grouping, some ECR repositories do not become a Record. This applies to a repository with no running image and no finding of its own. -* Security Hub does not show which images run. The connector reads this from Amazon Inspector with `inspector2:ListCoverage`. It reads once per account and region for each Record that it syncs. For an ECR repository Record, it reads only that repository. Under a finer grouping, discovery also reads once per account and region. +* Security Hub does not show which images run. The connector reads this from Amazon Inspector with `inspector2:ListCoverage`. It reads at least once per account and region for each Record that it syncs. For an ECR repository Record, it reads only that repository. Under a finer grouping, discovery also reads once per account and region. * For member accounts, the access key must belong to the Amazon Inspector delegated administrator account in each region. * If the toggle is on, saving the connection checks the `inspector2:ListCoverage` permission. If the permission goes missing later, the Sync of each Record with image findings fails. Under a finer grouping, discovery also fails. The findings stay as they were. * If Inspector covers no images at all for an account and region, the connector skips its Records with image findings. This happens when ECR scanning is off in that region. It also happens when the access key is not the delegated administrator for a member account. The findings of a skipped Record stay as they were, and the connector logs a warning. The skip covers all findings of the Record, not only image findings. Under the default grouping, the EC2, IAM and AWS Config findings of that account and region also stop syncing. This lasts until Inspector can see the account. Under the **Resource Type** grouping, only the ECR repository Record skips. Under the **Resource** grouping, the connector asks Inspector about each ECR repository on its own. If Inspector covers no image for a repository, only the Record of that repository skips. Discovery leaves out the image findings of an account and region that Inspector cannot see. From 8c9333ecd213d9690f4719935e97ebd9c68dc615 Mon Sep 17 00:00:00 2001 From: Sam Vader Date: Fri, 23 Oct 2026 14:37:49 -0500 Subject: [PATCH 6/7] docs(connectors): Security Hub ECR in-use findings can stay open up to two days after an image stops --- docs/content/connectors/toolreference/security_hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/content/connectors/toolreference/security_hub.md b/docs/content/connectors/toolreference/security_hub.md index fd629f690d7..6b82e47f5a5 100644 --- a/docs/content/connectors/toolreference/security_hub.md +++ b/docs/content/connectors/toolreference/security_hub.md @@ -98,7 +98,7 @@ If the toggle is on, the connector checks each finding on an ECR container image * The connector imports findings on every other resource as before. This includes the ECR repository's own findings. * Only Amazon ECS tasks and Amazon EKS pods count, also on AWS Fargate. An image that runs anywhere else counts as not running. This includes AWS Lambda, AWS App Runner, Docker on EC2 and self-managed Kubernetes. -* Amazon Inspector updates the in-use data once a day. For a new image, the data can take up to 36 hours to show. See [Mapping container images to running containers](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html#ecr-mapping-container-images) in the Amazon Inspector documentation. +* Amazon Inspector updates the in-use data once a day. For a new image, the data can take up to 36 hours to show. After an image stops, its findings can stay open for up to two days. See [Mapping container images to running containers](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html#ecr-mapping-container-images) in the Amazon Inspector documentation. * Amazon Inspector ECR scanning must be on in every region that you sync. Amazon Inspector supplies in-use data only for ECR repositories that use continuous scanning. If a repository uses scan on push, the next Sync closes its image findings, even if the image runs. * Amazon Inspector does not support last-in-use tracking for multi-architecture images. Before you rely on the toggle for such an image, check that Amazon Inspector shows it as in use. * At the next Sync, DefectDojo closes the imported findings of images that do not run. If an image runs again, its findings reopen at a later Sync. From b0e9d4729bba1820e1850b669cd8866b927adf6d Mon Sep 17 00:00:00 2001 From: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Date: Fri, 30 Oct 2026 18:03:31 -0600 Subject: [PATCH 7/7] docs(connectors): Security Hub records Inspector cannot see now fail instead of skipping Co-Authored-By: Claude Opus 5.5 --- docs/content/connectors/toolreference/security_hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/content/connectors/toolreference/security_hub.md b/docs/content/connectors/toolreference/security_hub.md index 6b82e47f5a5..de28ee05030 100644 --- a/docs/content/connectors/toolreference/security_hub.md +++ b/docs/content/connectors/toolreference/security_hub.md @@ -107,7 +107,7 @@ If the toggle is on, the connector checks each finding on an ECR container image * Security Hub does not show which images run. The connector reads this from Amazon Inspector with `inspector2:ListCoverage`. It reads at least once per account and region for each Record that it syncs. For an ECR repository Record, it reads only that repository. Under a finer grouping, discovery also reads once per account and region. * For member accounts, the access key must belong to the Amazon Inspector delegated administrator account in each region. * If the toggle is on, saving the connection checks the `inspector2:ListCoverage` permission. If the permission goes missing later, the Sync of each Record with image findings fails. Under a finer grouping, discovery also fails. The findings stay as they were. -* If Inspector covers no images at all for an account and region, the connector skips its Records with image findings. This happens when ECR scanning is off in that region. It also happens when the access key is not the delegated administrator for a member account. The findings of a skipped Record stay as they were, and the connector logs a warning. The skip covers all findings of the Record, not only image findings. Under the default grouping, the EC2, IAM and AWS Config findings of that account and region also stop syncing. This lasts until Inspector can see the account. Under the **Resource Type** grouping, only the ECR repository Record skips. Under the **Resource** grouping, the connector asks Inspector about each ECR repository on its own. If Inspector covers no image for a repository, only the Record of that repository skips. Discovery leaves out the image findings of an account and region that Inspector cannot see. +* If Inspector covers no images at all for an account and region, the Sync of its Records with image findings fails, with an error that says why. This happens when ECR scanning is off in that region. It also happens when the access key is not the delegated administrator for a member account. The findings of a failed Record stay as they were. The failure covers all findings of the Record, not only image findings. Under the default grouping, the EC2, IAM and AWS Config findings of that account and region also stop syncing until Inspector can see the account, or until you turn the toggle off. Under the **Resource Type** grouping, only the ECR repository Record fails. Under the **Resource** grouping, the connector asks Inspector about each ECR repository on its own. If Inspector covers no image for a repository, only the Record of that repository fails. Discovery leaves out the image findings of an account and region that Inspector cannot see. * The connector never imports every image as a fallback. * The connector still reads every finding from Security Hub. That part of a Sync takes as long as before. Each Record with image findings adds at least one Amazon Inspector request. Under the **Resource** grouping, that means about one request per ECR repository Record. Only the number of imported findings goes down.