aws-eks-workload-pulls-ecr-image
A Kubernetes pod/deployment references (pulls and runs) a container image from an ECR repository. Records the tag/digest for mutability assessment.
match (record)
{
"field": "spec.containers[].image",
"resource_type": "k8s:Pod"
}
where
image URI matches an ECR registry (*.dkr.ecr.*.amazonaws.com/<repo>:<tag-or-digest>)
emit
| source type | KubernetesWorkload |
|---|---|
| target type | * |
| source | <KubernetesWorkload (pod/deployment)> |
| target | <ContainerRegistry (ECR repository)> |
Narrative
Pod {pod.name} references ECR image {image_uri} (reference_kind=runs_image). Mutable: {mutable} (digest-pinned: {image_digest != null}). imagePullPolicy: {image_pull_policy}. Container-chains image-push-poisons-consumers will fan out CanModifyCode from a registry push to this workload only when mutable=true and a re-pull occurs.
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-workload-pulls-ecr-image
emits: ContainsResourceReference
description: A Kubernetes pod/deployment references (pulls and runs) a container image from an ECR repository.
Records the tag/digest for mutability assessment.
match_record:
resource_type: k8s:Pod
field: spec.containers[].image
where:
- image URI matches an ECR registry (*.dkr.ecr.*.amazonaws.com/<repo>:<tag-or-digest>)
emit:
target_type: '*'
source_type: KubernetesWorkload
source: <KubernetesWorkload (pod/deployment)>
target: <ContainerRegistry (ECR repository)>
api_source: kubectl get pod -o json
evidence_field: spec.containers[].image
properties:
reference_kind: runs_image
image_tag: <tag portion of the image URI, e.g. latest>
image_digest: <sha256:... digest if pinned, else null>
mutable: <true if referenced by mutable tag (no digest pin); false if @sha256 digest-pinned>
image_pull_policy: <Always | IfNotPresent | Never>
narrative: 'Pod {pod.name} references ECR image {image_uri} (reference_kind=runs_image). Mutable: {mutable}
(digest-pinned: {image_digest != null}). imagePullPolicy: {image_pull_policy}. Container-chains image-push-poisons-consumers
will fan out CanModifyCode from a registry push to this workload only when mutable=true and a re-pull
occurs.'