AWS ECR Image Vulnerability Scan Sentinel

id: aws-ecr-vulnerability-scan-sentinel
namespace: company.security

description: |
  Polls Amazon ECR repository image vulnerability scan findings via AwsCLI,
  evaluates CRITICAL and HIGH severity vulnerabilities, branches via conditional
  logic, files an automated GitHub security remediation issue, and alerts
  on-call SecOps engineers on Slack.

inputs:
  - id: aws_region
    type: STRING
    displayName: AWS Region
    defaults: us-east-1

  - id: repository_name
    type: STRING
    displayName: ECR Repository Name
    defaults: production-backend-app

  - id: image_tag
    type: STRING
    displayName: Container Image Tag
    defaults: latest

  - id: github_repository
    type: STRING
    displayName: GitHub Target Security Repository
    defaults: my-org/security-remediations

triggers:
  - id: daily_ecr_security_scan
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "0 6 * * *"
    disabled: true

tasks:
  - id: probe_ecr_scan_findings
    type: io.kestra.plugin.aws.cli.AwsCLI
    description: Inspects AWS ECR image vulnerability scan findings using AWS CLI
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    region: "{{ inputs.aws_region }}"
    commands:
      - aws ecr describe-image-scan-findings --repository-name {{
        inputs.repository_name }} --image-id imageTag={{ inputs.image_tag }}
        --output json | tr -d '\n' | xargs -0 -I {} echo '::{"outputs":{}}::'

  - id: evaluate_vulnerability_counts
    type: io.kestra.plugin.core.debug.Return
    description: Extracts critical and high vulnerability counts from scan findings
    format:
      critical_count: "{{
        outputs.probe_ecr_scan_findings.vars.imageScanFindings.findingSeverityC\
        ounts.CRITICAL ?? 0 }}"
      high_count: "{{
        outputs.probe_ecr_scan_findings.vars.imageScanFindings.findingSeverityC\
        ounts.HIGH ?? 0 }}"
      medium_count: "{{
        outputs.probe_ecr_scan_findings.vars.imageScanFindings.findingSeverityC\
        ounts.MEDIUM ?? 0 }}"
      has_high_or_critical: "{{
        (outputs.probe_ecr_scan_findings.vars.imageScanFindings.findingSeverity\
        Counts.CRITICAL ?? 0) > 0 or
        (outputs.probe_ecr_scan_findings.vars.imageScanFindings.findingSeverity\
        Counts.HIGH ?? 0) > 0 }}"

  - id: branch_on_vulnerabilities
    type: io.kestra.plugin.core.flow.If
    description: Evaluates whether critical or high severity vulnerabilities exist
    condition: "{{ outputs.evaluate_vulnerability_counts.value.has_high_or_critical
      == true }}"
    then:
      - id: create_github_security_issue
        type: io.kestra.plugin.github.issues.Create
        description: Automatically logs CVE vulnerability report on GitHub security tracker
        oauthToken: "{{ secret('GITHUB_TOKEN') }}"
        repository: "{{ inputs.github_repository }}"
        title: "[Security] Critical/High Vulnerabilities Detected in ECR: {{
          inputs.repository_name }}:{{ inputs.image_tag }}"
        body: |
          ## 🚨 AWS ECR Container Image Vulnerability Alert

          Automated container security scanner identified vulnerabilities in container image:
          - **ECR Repository:** `{{ inputs.repository_name }}`
          - **Image Tag:** `{{ inputs.image_tag }}`
          - **AWS Region:** `{{ inputs.aws_region }}`

          ### Severity Breakdown:
          - **CRITICAL:** `{{ outputs.evaluate_vulnerability_counts.value.critical_count }}`
          - **HIGH:** `{{ outputs.evaluate_vulnerability_counts.value.high_count }}`
          - **MEDIUM:** `{{ outputs.evaluate_vulnerability_counts.value.medium_count }}`

          Please review AWS ECR console or rebuild container base images with patched packages immediately.
          *Generated by Kestra AWS ECR Vulnerability Sentinel.*

      - id: alert_secops_slack
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Alerts SecOps Slack channel with vulnerability count and GitHub
          issue link
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {{ {
            "text": "🚨 *AWS ECR Container Vulnerabilities Detected*\n*Repository:* `" ~ inputs.repository_name ~ ":" ~ inputs.image_tag ~ "` in `" ~ inputs.aws_region ~ "`\n*Severities:* Critical: *" ~ outputs.evaluate_vulnerability_counts.value.critical_count ~ "*, High: *" ~ outputs.evaluate_vulnerability_counts.value.high_count ~ "*\n*Action:* Issue created <" ~ (outputs.create_github_security_issue.issueUrl ?? "#") ~ "|View GitHub Issue>"
          } | toJson }}

    else:
      - id: log_clean_image
        type: io.kestra.plugin.core.log.Log
        message: "No CRITICAL or HIGH vulnerabilities discovered for {{
          inputs.repository_name }}:{{ inputs.image_tag }}. Image scan passed."

  - id: log_audit_summary
    type: io.kestra.plugin.core.log.Log
    description: Audit trail summarizing the ECR vulnerability evaluation execution
    message: "AWS ECR security scan completed for {{ inputs.repository_name }}:{{
      inputs.image_tag }}. Critical={{
      outputs.evaluate_vulnerability_counts.value.critical_count }}, High={{
      outputs.evaluate_vulnerability_counts.value.high_count }}."

errors:
  - id: alert_scan_flow_error
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Dispatches alert when ECR scan check encounters an unexpected failure
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {{ {
        "text": "⚠️ *AWS ECR Scan Sentinel Execution Error* in flow `" ~ flow.id ~ "` (execution `" ~ execution.id ~ "`). Failed to query ECR findings for `" ~ inputs.repository_name ~ ":" ~ inputs.image_tag ~ "`."
      } | toJson }}