Lesson 05 — Image Vulnerability Scanning

Learning Objectives

By the end of this lesson, you will be able to:

Understand what Image Vulnerability Scanning is
Learn how vulnerabilities enter container images
Understand CVEs and CVSS severity ratings
Explore image scanning tools and workflows
Integrate vulnerability scanning into CI/CD pipelines
Protect Amazon EKS workloads using automated image scanning
Apply enterprise vulnerability management best practices

Why This Matters

Every container image contains software components such as:

Operating system packages
Application frameworks
Programming language runtimes
Third-party libraries
Open-source dependencies

These components may contain known security vulnerabilities.

If vulnerable images are deployed into production, attackers can exploit them to:

Execute remote code
Escalate privileges
Steal sensitive data
Compromise applications
Move laterally across Kubernetes clusters

Image Vulnerability Scanning helps identify these risks before containers reach production.

What is Image Vulnerability Scanning?

Image Vulnerability Scanning is the process of analysing a container image to identify known security vulnerabilities.

The scanner examines:

Operating system packages
Installed libraries
Programming language dependencies
Application frameworks
Configuration issues

The results are compared against vulnerability databases to identify known security issues.

Image Scanning Lifecycle

Developer

↓

Dockerfile

↓

Build Image

↓

Image Scan

↓

Security Policy

↓

Amazon ECR

↓

Amazon EKS

Images should be scanned before they are stored or deployed.

How Vulnerabilities Enter Images

Vulnerabilities rarely originate from the application itself.

Most are inherited from dependencies.

Base Image

↓

Operating System Packages

↓

Application Libraries

↓

Third-Party Dependencies

↓

Container Image

↓

Production

Every layer of the image should be assessed.

What is a CVE?

A Common Vulnerabilities and Exposures (CVE) identifier uniquely identifies a publicly disclosed security vulnerability.

Example:

CVE-2025-12345

Each CVE contains information about:

Affected software
Severity
Exploitation details
Available patches
Mitigation guidance

CVSS Severity Ratings

Most scanners classify vulnerabilities using the Common Vulnerability Scoring System (CVSS).

Severity	Typical CVSS Score
Critical	9.0 – 10.0
High	7.0 – 8.9
Medium	4.0 – 6.9
Low	0.1 – 3.9

Enterprise security teams often block deployments containing Critical or High vulnerabilities.

What Does a Scanner Check?

A vulnerability scanner analyses:

Base operating system
Installed packages
Programming language libraries
Open-source dependencies
Known CVEs
Configuration issues
Unsupported software versions

Scanning provides visibility into inherited risks.

Example Scan Results

Image

↓

Scan Complete

↓

Critical : 1

High : 3

Medium : 8

Low : 15

Security teams prioritize remediation based on severity and business impact.

Types of Image Vulnerabilities

Common findings include:

Remote Code Execution (RCE)
Privilege Escalation
Buffer Overflows
Authentication Bypass
SQL Injection libraries
Outdated OpenSSL
Vulnerable Log4j versions
Weak cryptographic libraries

Early detection significantly reduces organizational risk.

Image Scanning Tools

Enterprise organizations use a variety of scanning solutions.

Tool	Purpose
Amazon ECR Enhanced Scanning	Native AWS image vulnerability scanning
Amazon Inspector	Continuous vulnerability assessment
Trivy	Open-source image scanner
Grype	Open-source vulnerability scanner
Snyk Container	Developer-focused image scanning
Aqua Security	Enterprise container security
Prisma Cloud	Cloud-native security platform
Sysdig Secure	Image and runtime security

Many organizations use multiple tools for layered security.

Amazon ECR Enhanced Scanning

Amazon ECR provides integrated vulnerability scanning.

Features include:

Continuous image scanning
CVE detection
Severity classification
Integration with Amazon Inspector
Automatic notifications
Centralized findings

This enables organizations to monitor images throughout their lifecycle.

Amazon Inspector

Amazon Inspector continuously evaluates:

Container images
EC2 instances
Lambda functions

For container images, Inspector:

Identifies new vulnerabilities
Updates findings automatically
Prioritizes risks
Integrates with AWS Security Hub

Images continue to be assessed even after they have been stored in Amazon ECR.

CI/CD Image Scanning

Scanning should occur automatically during builds.

Developer

↓

Git Push

↓

CI/CD Pipeline

↓

Build Image

↓

Image Scan

↓

Pass

↓

Amazon ECR

--------------------

Fail

↓

Deployment Blocked

Only approved images should proceed to production.

Shift-Left Security

Image scanning supports the Shift-Left security model.

Develop

↓

Build

↓

Scan

↓

Fix

↓

Deploy

The earlier vulnerabilities are discovered, the less expensive they are to remediate.

Vulnerability Remediation

When vulnerabilities are identified:

Scanner

↓

Report Generated

↓

Developer

↓

Update Packages

↓

Rebuild Image

↓

Rescan

↓

Deploy

Images should always be rescanned after remediation.

Continuous Scanning

Security does not stop after deployment.

New CVEs are discovered every day.

Stored Image

↓

New CVE Published

↓

Automatic Rescan

↓

Security Alert

Continuous scanning identifies newly discovered vulnerabilities affecting previously approved images.

Enterprise Amazon EKS Architecture

Developer

↓

Git Repository

↓

CI/CD Pipeline

↓

Build Image

↓

Amazon ECR

↓

Amazon Inspector

↓

AWS Security Hub

↓

Amazon EKS

Security findings become part of the organization’s continuous compliance programme.

Enterprise Example

A multinational healthcare provider maintains thousands of container images in Amazon ECR.

Every image must:

Pass vulnerability scanning
Contain no Critical vulnerabilities
Be digitally signed
Use approved base images
Meet internal compliance requirements

One morning, Amazon Inspector identifies a newly published Critical OpenSSL vulnerability affecting several production images.

The platform team:

Rebuilds the affected images
Applies the patched OpenSSL package
Rescans the images
Pushes the updated images to Amazon ECR
Deploys the patched containers using Amazon EKS rolling updates

Within hours, the organization eliminates the vulnerability across hundreds of workloads.

Common Vulnerability Scanning Risks

Cloud Security Engineers frequently discover:

Images never scanned
Outdated base images
Ignored Critical CVEs
Unsupported operating systems
Missing dependency updates
Manual scanning processes
Missing CI/CD integration
Inconsistent scanner configuration
Images deployed despite High severity findings
Lack of continuous scanning

These weaknesses significantly increase software supply chain risk.

Enterprise Monitoring

Security teams should monitor:

Critical vulnerabilities
High severity vulnerabilities
Newly disclosed CVEs
Base image updates
Scan failures
Image age
Registry activity
Inspector findings
Security Hub findings
Compliance dashboards

Continuous monitoring helps ensure vulnerabilities are identified and remediated quickly.

Enterprise Implementation Strategy

A recommended rollout:

Step 1

↓

Approve Base Images

↓

Step 2

↓

Integrate Image Scanning

↓

Step 3

↓

Configure Scan Policies

↓

Step 4

↓

Block Critical Findings

↓

Step 5

↓

Store Images in Amazon ECR

↓

Step 6

↓

Enable Amazon Inspector

↓

Step 7

↓

Monitor Security Hub

↓

Step 8

↓

Continuously Patch & Rebuild

This approach embeds vulnerability management into the software delivery process.

Best Practices

As a Kubernetes Security Engineer:

Scan every image before deployment.
Enable continuous scanning for stored images.
Prioritize Critical and High severity vulnerabilities.
Keep base images regularly updated.
Automate vulnerability scanning in CI/CD pipelines.
Never deploy images with unapproved Critical vulnerabilities.
Integrate Amazon Inspector with Amazon ECR and AWS Security Hub.
Regularly rebuild images using updated dependencies.
Monitor newly disclosed CVEs continuously.
Combine image scanning with image signing and runtime security.

Image Vulnerability Scanning is a fundamental component of secure container supply chains.

Real-World Scenario

A software company deploys a customer portal on Amazon EKS.

Several weeks after deployment, a Critical vulnerability is disclosed in a widely used OpenSSL library.

Because Amazon Inspector continuously scans Amazon ECR repositories:

The affected image is automatically identified.
Security Hub creates a new finding.
The platform team receives an alert.
Developers rebuild the image using the patched library.
The new image passes vulnerability scanning.
Amazon EKS performs a rolling deployment of the updated containers.

The vulnerability is remediated before attackers can exploit it.

Key Takeaways

After completing this lesson, you should understand:

What Image Vulnerability Scanning is
How vulnerabilities enter container images
CVEs and CVSS severity ratings
Enterprise image scanning tools
Amazon ECR Enhanced Scanning and Amazon Inspector
CI/CD integration
Continuous vulnerability management
Best practices for Amazon EKS

Image Vulnerability Scanning enables organizations to identify and remediate known security vulnerabilities before they become production incidents. Combined with secure Dockerfiles, trusted base images, image signing and runtime protection, it forms a critical component of Kubernetes supply chain security.

Knowledge Check

Question 1

What is the primary purpose of Image Vulnerability Scanning?

A. Improve container startup time
B. Identify known security vulnerabilities in container images
C. Configure Kubernetes networking
D. Replace runtime monitoring

Answer: B

Question 2

What does a CVE represent?

A. A container registry
B. A publicly disclosed security vulnerability with a unique identifier
C. A Kubernetes Namespace
D. A Docker image layer

Answer: B

Question 3

Which AWS service continuously evaluates Amazon ECR images for newly disclosed vulnerabilities?

A. Amazon EC2
B. Amazon Inspector
C. Amazon Route 53
D. AWS CloudFormation

Answer: B

Question 4

When should container images be scanned?

A. Only after deployment
B. Only once during development
C. Before deployment and continuously throughout their lifecycle
D. Only after a security incident

Answer: C

Question 5

Which combination represents enterprise best practice?

A. Scan images in CI/CD, block Critical vulnerabilities, enable continuous scanning, integrate with Amazon Inspector and AWS Security Hub, and regularly rebuild images with security updates.
B. Deploy images without scanning if they originate from public registries.
C. Ignore High severity vulnerabilities if the application appears to work correctly.
D. Perform manual image scanning once a year.

Answer: A

What’s Next?

In the next lesson, you will learn about Image Signing & Verification, exploring how digital signatures verify image authenticity and integrity, prevent image tampering, and ensure that only trusted container images are deployed into Amazon EKS production environments.

➡️ Next Lesson: Lesson 06 — Image Signing & Verification