<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: securing-container-registries
description: >-
  Secure container registries (ECR, ACR, GCR/Artifact Registry) through image scanning,
  access policies, signing, immutable tags, and supply chain integrity controls.
domain: cybersecurity
subdomain: cloud-security
tags:
  - containers
  - ecr
  - acr
  - artifact-registry
  - image-scanning
  - supply-chain
  - cosign
  - sbom
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002", "T1525"]
---

# Securing Container Registries

## Overview

Container registries are a critical supply chain component — compromised images can
deploy malware, backdoors, or vulnerable dependencies across entire clusters. This skill
covers hardening ECR/ACR/Artifact Registry through vulnerability scanning, access
policies, image signing with cosign/Notation, immutable tags, SBOM generation, and
admission control enforcement.

Mode: `[MODE: ARCHITECT]` — Supply chain security architecture.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS ECR, Azure ACR, or GCP Artifact Registry access | Required |
| Container scanning tools | Trivy, Grype, or cloud-native scanners |
| Image signing | `cosign` or `notation` |
| Python 3.10+ with cloud SDKs | Required |
| Optional | OPA/Gatekeeper or Kyverno for admission control |

## Key Concepts

### Image Vulnerability Scanning

```bash
# AWS ECR — Enable enhanced scanning
aws ecr put-registry-scanning-configuration --scan-type ENHANCED \
  --rules '[{"scanFrequency":"CONTINUOUS_SCAN","repositoryFilters":[{"filter":"*","filterType":"WILDCARD"}]}]'

# Scan on push
aws ecr put-image-scanning-configuration --repository-name REPO --image-scanning-configuration scanOnPush=true

# Get scan findings
aws ecr describe-image-scan-findings --repository-name REPO --image-id imageTag=latest

# Azure ACR — Enable Defender scanning
az acr update --name ACR_NAME --sku Premium
az security auto-provisioning-setting update --name "containerRegistryVulnerabilityAssessments" --auto-provision on

# GCP — Vulnerability scanning (automatic with Artifact Analysis)
gcloud artifacts docker images list LOCATION-docker.pkg.dev/PROJECT/REPO --show-occurrences

# Trivy — Local scan
trivy image --severity HIGH,CRITICAL --format json IMAGE:TAG > /tmp/trivy_scan.json

# Grype — Local scan
grype IMAGE:TAG --output json > /tmp/grype_scan.json
```

### Registry Access Control

```bash
# AWS ECR — Repository policy (restrict to specific accounts/roles)
aws ecr set-repository-policy --repository-name REPO --policy-text '{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "AllowPull",
    "Effect": "Allow",
    "Principal": {"AWS": ["arn:aws:iam::ACCOUNT:role/eks-node-role"]},
    "Action": ["ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage"]
  }]
}'

# Azure ACR — Network rules
az acr network-rule add --name ACR_NAME --ip-address CIDR

# GCP — IAM binding for Artifact Registry
gcloud artifacts repositories add-iam-policy-binding REPO \
  --location=LOCATION --member="serviceAccount:SA@PROJECT.iam.gserviceaccount.com" \
  --role="roles/artifactregistry.reader"
```

### Image Signing with Cosign

```bash
# Generate key pair
cosign generate-key-pair

# Sign image
cosign sign --key cosign.key IMAGE@DIGEST

# Verify signature
cosign verify --key cosign.pub IMAGE@DIGEST

# Sign with keyless (Sigstore)
cosign sign IMAGE@DIGEST  # Uses OIDC identity

# Verify keyless signature
cosign verify IMAGE@DIGEST --certificate-identity USER@DOMAIN --certificate-oidc-issuer https://accounts.google.com
```

### Immutable Tags and Lifecycle

```bash
# AWS ECR — Enable tag immutability
aws ecr put-image-tag-mutability --repository-name REPO --image-tag-mutability IMMUTABLE

# AWS ECR — Lifecycle policy (expire untagged images)
aws ecr put-lifecycle-policy --repository-name REPO --lifecycle-policy-text '{
  "rules": [{
    "rulePriority": 1,
    "description": "Expire untagged images older than 14 days",
    "selection": {"tagStatus": "untagged", "countType": "sinceImagePushed", "countUnit": "days", "countNumber": 14},
    "action": {"type": "expire"}
  }]
}'

# Azure ACR — Retention policy
az acr config retention update --registry ACR_NAME --status Enabled --days 30 --type UntaggedManifests
```

### SBOM Generation

```bash
# Generate SBOM with Syft
syft IMAGE:TAG -o spdx-json > sbom.spdx.json

# Attach SBOM to image with cosign
cosign attach sbom --sbom sbom.spdx.json IMAGE@DIGEST

# Generate SBOM with Trivy
trivy image --format spdx-json IMAGE:TAG > sbom.json
```

### Admission Control

```bash
# Kyverno — Require signed images
cat <<EOF | kubectl apply -f -
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-signed-images
spec:
  validationFailureAction: Enforce
  rules:
  - name: verify-signature
    match:
      any:
      - resources:
          kinds: ["Pod"]
    verifyImages:
    - imageReferences: ["registry.example.com/*"]
      attestors:
      - entries:
        - keys:
            publicKeys: |-
              -----BEGIN PUBLIC KEY-----
              ...
              -----END PUBLIC KEY-----
EOF
```

## Workflow

### Step 1: Inventory Registries

```bash
node scripts/agent.js --provider aws --action inventory --output /tmp/registry_inventory.json
```

### Step 2: Audit Security Configuration

```bash
node scripts/agent.js --provider aws --action audit --output /tmp/registry_audit.json
```

### Step 3: Scan Images

```bash
node scripts/agent.js --provider aws --action scan --repo my-app --output /tmp/image_scan.json
```

## Detection

```yaml
title: Securing Container Registries Detection
id: bfe07c4d-e36c-4c90-bb21-f4f84ffd4f03
status: experimental
description: Detects suspicious activity related to securing container registries techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.t1525
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Securing Container Registries Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002, T1525 |

## Verification

- [ ] Image scanning enabled on push (all repositories)
- [ ] No critical/high vulnerabilities in production images
- [ ] Registry access restricted to authorized principals
- [ ] Image tag immutability enabled on production repositories
- [ ] Lifecycle policies configured to clean untagged images
- [ ] Image signing enforced for production deployments
- [ ] SBOM generated and attached for all release images
- [ ] Admission controller enforces signed-image policy
- [ ] Base images updated within 30 days of security patches

## References

- [AWS ECR Security Best Practices](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security.html)
- [Sigstore / Cosign](https://docs.sigstore.dev/)
- [SLSA Supply Chain Framework](https://slsa.dev/)
- [NIST SP 800-190 — Container Security Guide](https://csrc.nist.gov/publications/detail/sp/800-190/final)
- [CIS Docker Benchmark](https://www.cisecurity.org/benchmark/docker)
