aws-ecr-image-layer-content
Container image layers preserve files from every build layer and commonly expose deleted .env files, package credentials, and private keys.
Where it sits
| location | GetDownloadUrlForLayer.downloadUrl -> layer tar contents |
|---|
| location kind | code_artifact |
|---|
| data kinds | source_code_secret credential password api_key access_key secret_key private_key |
|---|
| emits edge | CanReadData |
|---|
| service | ECR (aws:ecr) |
|---|
Collection recipe
| access mode | read_api |
|---|
| operation | GetDownloadUrlForLayer |
|---|
| response path | downloadUrl -> layer tar bytes |
|---|
| encoding | binary |
|---|
| params | {"layerDigest": "\u003csha256-digest\u003e", "repositoryName": "\u003crepository\u003e"} |
|---|
Required permissions
ecr:GetDownloadUrlForLayer
ecr:BatchGetImage
References