Skip to content
AWS for Query.Farm

aws.ecr.describe_image_scan_findings

Example SQL Queries

SELECT * FROM
aws.ecr.describe_image_scan_findings
WHERE
"repository_name" = 'VALUE'
AND "image_id" = 'VALUE';

Description

Returns the scan findings for the specified image.

Table Definition

Column NameColumn Data Type
image_id Required Input Column

An object with identifying information for an image in an Amazon ECR repository.

STRUCT(
    "image_digest" VARCHAR,
    "image_tag" VARCHAR
)
Show child fields
image_id.image_digest

The sha256 digest of the image manifest.

image_id.image_tag

The tag used for the image.

repository_name Required Input Column

The repository name associated with the request.

VARCHAR
registry_id Input Column

The registry ID associated with the request.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

image_scan_findings

The information contained in the image scan findings.

STRUCT(
    "image_scan_completed_at" TIMESTAMP_S,
    "vulnerability_source_updated_at" TIMESTAMP_S,
    "finding_severity_counts" MAP(VARCHAR, BIGINT),
    "findings" STRUCT(
        "name" VARCHAR,
        "description" VARCHAR,
        "uri" VARCHAR,
        "severity" VARCHAR,
        "attributes" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[]
    )[],
    "enhanced_findings" STRUCT(
        "aws_account_id" VARCHAR,
        "description" VARCHAR,
        "finding_arn" VARCHAR,
        "first_observed_at" TIMESTAMP_S,
        "last_observed_at" TIMESTAMP_S,
        "package_vulnerability_details" STRUCT(
            "cvss" STRUCT(
                "base_score" DOUBLE,
                "scoring_vector" VARCHAR,
                "source" VARCHAR,
                "version" VARCHAR
            )[],
            "reference_urls" VARCHAR[],
            "related_vulnerabilities" VARCHAR[],
            "source" VARCHAR,
            "source_url" VARCHAR,
            "vendor_created_at" TIMESTAMP_S,
            "vendor_severity" VARCHAR,
            "vendor_updated_at" TIMESTAMP_S,
            "vulnerability_id" VARCHAR,
            "vulnerable_packages" STRUCT(
                "arch" VARCHAR,
                "epoch" BIGINT,
                "file_path" VARCHAR,
                "name" VARCHAR,
                "package_manager" VARCHAR,
                "release" VARCHAR,
                "source_layer_hash" VARCHAR,
                "version" VARCHAR
            )[]
        ),
        "remediation" STRUCT(
            "recommendation" STRUCT(
                "url" VARCHAR,
                "text" VARCHAR
            )
        ),
        "resources" STRUCT(
            "details" STRUCT(
                "aws_ecr_container_image" STRUCT(
                    "architecture" VARCHAR,
                    "author" VARCHAR,
                    "image_hash" VARCHAR,
                    "image_tags" VARCHAR[],
                    "platform" VARCHAR,
                    "pushed_at" TIMESTAMP_S,
                    "registry" VARCHAR,
                    "repository_name" VARCHAR
                )
            ),
            "id" VARCHAR,
            "tags" MAP(VARCHAR, VARCHAR),
            "type" VARCHAR
        )[],
        "score" DOUBLE,
        "score_details" STRUCT(
            "cvss" STRUCT(
                "adjustments" STRUCT(
                    "metric" VARCHAR,
                    "reason" VARCHAR
                )[],
                "score" DOUBLE,
                "score_source" VARCHAR,
                "scoring_vector" VARCHAR,
                "version" VARCHAR
            )
        ),
        "severity" VARCHAR,
        "status" VARCHAR,
        "title" VARCHAR,
        "type" VARCHAR,
        "updated_at" TIMESTAMP_S
    )[]
)
Show child fields
image_scan_findings.enhanced_findings[]
Show child fields
image_scan_findings.enhanced_findings[].aws_account_id

The Amazon Web Services account ID associated with the image.

image_scan_findings.enhanced_findings[].description

The description of the finding.

image_scan_findings.enhanced_findings[].finding_arn

The Amazon Resource Number (ARN) of the finding.

image_scan_findings.enhanced_findings[].first_observed_at

The date and time that the finding was first observed.

image_scan_findings.enhanced_findings[].last_observed_at

The date and time that the finding was last observed.

image_scan_findings.enhanced_findings[].package_vulnerability_details

An object that contains the details of a package vulnerability finding.

Show child fields
image_scan_findings.enhanced_findings[].package_vulnerability_details.cvss[]
Show child fields
image_scan_findings.enhanced_findings[].package_vulnerability_details.cvss[].base_score

The base CVSS score used for the finding.

image_scan_findings.enhanced_findings[].package_vulnerability_details.cvss[].scoring_vector

The vector string of the CVSS score.

image_scan_findings.enhanced_findings[].package_vulnerability_details.cvss[].source

The source of the CVSS score.

image_scan_findings.enhanced_findings[].package_vulnerability_details.cvss[].version

The version of CVSS used for the score.

image_scan_findings.enhanced_findings[].package_vulnerability_details.reference_urls[]
image_scan_findings.enhanced_findings[].package_vulnerability_details.related_vulnerabilities[]
image_scan_findings.enhanced_findings[].package_vulnerability_details.source

The source of the vulnerability information.

image_scan_findings.enhanced_findings[].package_vulnerability_details.source_url

A URL to the source of the vulnerability information.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vendor_created_at

The date and time that this vulnerability was first added to the vendor's database.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vendor_severity

The severity the vendor has given to this vulnerability type.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vendor_updated_at

The date and time the vendor last updated this vulnerability in their database.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerability_id

The ID given to this vulnerability.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[]
Show child fields
image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[].arch

The architecture of the vulnerable package.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[].epoch

The epoch of the vulnerable package.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[].file_path

The file path of the vulnerable package.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[].name

The name of the vulnerable package.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[].package_manager

The package manager of the vulnerable package.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[].release

The release of the vulnerable package.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[].source_layer_hash

The source layer hash of the vulnerable package.

image_scan_findings.enhanced_findings[].package_vulnerability_details.vulnerable_packages[].version

The version of the vulnerable package.

image_scan_findings.enhanced_findings[].remediation

An object that contains the details about how to remediate a finding.

Show child fields
image_scan_findings.enhanced_findings[].remediation.recommendation

An object that contains information about the recommended course of action to remediate the finding.

Show child fields
image_scan_findings.enhanced_findings[].remediation.recommendation.text

The recommended course of action to remediate the finding.

image_scan_findings.enhanced_findings[].remediation.recommendation.url

The URL address to the CVE remediation recommendations.

image_scan_findings.enhanced_findings[].resources[]
Show child fields
image_scan_findings.enhanced_findings[].resources[].details

An object that contains details about the resource involved in a finding.

Show child fields
image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image

An object that contains details about the Amazon ECR container image involved in the finding.

Show child fields
image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image.architecture

The architecture of the Amazon ECR container image.

image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image.author

The image author of the Amazon ECR container image.

image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image.image_hash

The image hash of the Amazon ECR container image.

image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image.image_tags[]
image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image.platform

The platform of the Amazon ECR container image.

image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image.pushed_at

The date and time the Amazon ECR container image was pushed.

image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image.registry

The registry the Amazon ECR container image belongs to.

image_scan_findings.enhanced_findings[].resources[].details.aws_ecr_container_image.repository_name

The name of the repository the Amazon ECR container image resides in.

image_scan_findings.enhanced_findings[].resources[].id

The ID of the resource.

image_scan_findings.enhanced_findings[].resources[].tags

The tags attached to the resource.

image_scan_findings.enhanced_findings[].resources[].type

The type of resource.

image_scan_findings.enhanced_findings[].score

The Amazon Inspector score given to the finding.

image_scan_findings.enhanced_findings[].score_details

An object that contains details of the Amazon Inspector score.

Show child fields
image_scan_findings.enhanced_findings[].score_details.cvss

An object that contains details about the CVSS score given to a finding.

Show child fields
image_scan_findings.enhanced_findings[].score_details.cvss.adjustments[]
Show child fields
image_scan_findings.enhanced_findings[].score_details.cvss.adjustments[].metric

The metric used to adjust the CVSS score.

image_scan_findings.enhanced_findings[].score_details.cvss.adjustments[].reason

The reason the CVSS score has been adjustment.

image_scan_findings.enhanced_findings[].score_details.cvss.score

The CVSS score.

image_scan_findings.enhanced_findings[].score_details.cvss.score_source

The source for the CVSS score.

image_scan_findings.enhanced_findings[].score_details.cvss.scoring_vector

The vector for the CVSS score.

image_scan_findings.enhanced_findings[].score_details.cvss.version

The CVSS version used in scoring.

image_scan_findings.enhanced_findings[].severity

The severity of the finding.

image_scan_findings.enhanced_findings[].status

The status of the finding.

image_scan_findings.enhanced_findings[].title

The title of the finding.

image_scan_findings.enhanced_findings[].type

The type of the finding.

image_scan_findings.enhanced_findings[].updated_at

The date and time the finding was last updated at.

image_scan_findings.finding_severity_counts

The image vulnerability counts, sorted by severity.

image_scan_findings.findings[]
Show child fields
image_scan_findings.findings[].attributes[]
Show child fields
image_scan_findings.findings[].attributes[].key

The attribute key.

image_scan_findings.findings[].attributes[].value

The value assigned to the attribute key.

image_scan_findings.findings[].description

The description of the finding.

image_scan_findings.findings[].name

The name associated with the finding, usually a CVE number.

image_scan_findings.findings[].severity

The finding severity.

image_scan_findings.findings[].uri

A link containing additional details about the security vulnerability.

image_scan_findings.image_scan_completed_at

The time of the last completed image scan.

image_scan_findings.vulnerability_source_updated_at

The time when the vulnerability data was last scanned.

image_scan_status

The current state of the scan.

STRUCT(
    "status" VARCHAR,
    "description" VARCHAR
)
Show child fields
image_scan_status.description

The description of the image scan status.

image_scan_status.status

The current state of an image scan.