Hey DevOps folks and cloud builders! 👋
Big news from AWS: Amazon ECR (Elastic Container Registry) just got smarter with its Enhanced Scanning feature.
It now tells you not just what vulnerabilities exist in your container images — but also where and if those images are even being used in your ECS or EKS clusters.
🚀 What Changed?
Before
You could scan container images in ECR and get a list of vulnerabilities using Amazon Inspector.
Now (as of June 2025)
You also get usage insights, including:
- ✅ Last used date
- 📦 Number of ECS/EKS clusters using the image
- 🔗 Cluster ARNs (where the image is running)
This info is surfaced in both the ECR Console and Amazon Inspector.
🧠 Why This Matters
Let’s say you have dozens of images in ECR. You run a vulnerability scan and get alerts.
But…
- 🔍 Are those images even in use anymore?
- 💡 Which ones are actually powering your production apps?
Now you can know.
🛠️ Real-World Example
You have two images in ECR:
backend-service:latest
- Used in 3 EKS clusters
- Last used yesterday
legacy-app:v1.2
- ❌ Not used in any cluster
- Last used 8 months ago
With this update, you can now:
- Focus your remediation on the backend-service:latest image
- Safely ignore or delete legacy-app:v1.2
- Save time and effort by fixing only what really matters
💡 Benefits
- ✅ Prioritize vulnerabilities on actively-used images
- 🧹 Clean up unused/outdated images
- 🔐 Make smarter, faster security decisions
- 🔄 Automatically updates as image usage changes
🔍 Where to View It
- ECR Console → Scan results
- Amazon Inspector Console → Findings
- Or use APIs to fetch usage data programmatically
🧪 My Take
This update feels like a small tweak — but it massively boosts visibility and efficiency.
Perfect for teams juggling multiple microservices, environments, and deployments.
Less noise. More clarity. Smarter security. 💪
Have you tried this yet? Let me know what you think!
Top comments (0)