Private registry integration - AWS ECR

[scapotondo]

Question

Hey folks,

I'm trying to create a pipeline stage using GitlabCI where I analyze a previously uploaded docker image stored in ECR and I'm facing issues. Let me provide more information:

Error:
FATAL Fatal error image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: unable to find the specified image "<ecr-docker-image-url>" in ["docker" "containerd" "podman" "remote"]: 4 errors occurred: * docker error: unable to inspect the image (<ecr-docker-image-url>): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? * containerd error: containerd socket not found: /run/containerd/containerd.sock * podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory * remote error: GET : unexpected status code 401 Unauthorized: Not Authorized

Docker image used: https://hub.docker.com/r/bitnami/trivy/ version 0.52.2

I've tried stuff following documentation and taking a look at the proyect on my local machine but it haven't been enough. I'll share the GitlabCI job that I'm using

---

.image-scan:
  stage: image-scan
  image:
    name: docker.io/aquasec/trivy:latest
    entrypoint: [""]
  variables:
    GIT_STRATEGY: none
    YOUR_USERNAME: "<aws-user>"
    YOUR_PASSWORD: "<aws-pwd>"
    TRIVY_NO_PROGRESS: "true"
    TRIVY_CACHE_DIR: ".trivycache/"
    IMAGE: ${IMAGE_REPO}:${IMAGE_TAG}
  script:
    - trivy --version
    - TRIVY_PASSWORD=${YOUR_PASSWORD} trivy image --username ${YOUR_USERNAME} ${IMAGE}
  cache:
    paths:
      - .trivycache/
  artifacts:
    when: always
    reports:
      container_scanning: gl-container-scanning-report.json
  needs:
    - entry
    - build

IMAGE_REPO var points to the ecr repository and IMAGE_TAG to the tag for the specific project.

We're using pod identity to authenticate with aws

Documentation that I've used:

• https://aquasecurity.github.io/trivy/v0.52/docs/references/troubleshooting/#container-registry
• https://aquasecurity.github.io/trivy/v0.52/docs/advanced/private-registries/ecr/

Let me know if you need more information from my side

Target

AWS

Scanner

Misconfiguration

Output Format

None

Mode

Client/Server

Operating System

I'm using trivy inside a docker container

Version

0.52.2

[scapotondo]

hello folks, I've tagged you because you're the ones that Github suggests @shift @ocean @simon-engledew @umax

Do you have some insight related to my question? I can't use images stored in private registries in my gitlabci pipelines

[ocean]

Hi @scapotondo - I haven't set up Trivy in a while, so I might not be giving you the right info, but from your GitLab CI config you've included here, it doesn't look like you're providing Trivy with the service account permissions for ECR.

Have you tried adding config for something like what's under the IAM Role Service account heading on this page?

https://aquasecurity.github.io/trivy/v0.52/docs/advanced/private-registries/ecr/

Or if you have with the "pod identity" authentication, maybe try adding a test command of some kind to call the ECR just to get some kind of response, to verify the connection?