[REVIEW] aws-review: add ECR tag immutability and scanning evidence gates

[z707693052]

Skill Being Reviewed

Skill name: �ws-review
Skill path: skills/cloud/aws-review/

False Positive Analysis

Benign configuration that should not be over-flagged:
`hcl
resource "aws_ecr_repository" "dev" {
name = "dev-scratch"
image_tag_mutability = "IMMUTABLE_WITH_EXCLUSION"

image_tag_mutability_exclusion_filter {
filter_type = "WILDCARD"
filter = "latest-dev"
}
}
`

Why this is a false positive:
Modern ECR supports tag immutability with limited exclusions. A review should not fail every mutable-tag exception if the exception is documented, scoped to non-release tags, and production releases are immutable or digest-pinned.

Coverage Gaps

Missed variant 1: mutable production ECR tags
hcl resource "aws_ecr_repository" "api" { name = "prod-api" image_tag_mutability = "MUTABLE" }
Why it should be caught:
Mutable image tags allow a tag such as prod or �1.2.3 to be overwritten after deployment evidence is captured. That weakens rollback, provenance, and incident-response confidence.

Missed variant 2: repository has no scan-on-push or enhanced scanning evidence
hcl resource "aws_ecr_repository" "worker" { name = "prod-worker" }
Why it should be caught:
The current AWS review focuses on CIS Foundations controls and misses ECR scanning posture. Reviewers should ask whether repositories use scan-on-push, registry-level enhanced scanning, or Amazon Inspector continuous scanning.

Missed variant 3: broad ECR repository policy or no lifecycle/rollback evidence
json { "Effect": "Allow", "Principal": "*", "Action": ["ecr:BatchGetImage", "ecr:PutImage"] }
Why it should be caught:
Broad push/pull access can let untrusted principals publish or consume images, and lifecycle policies should preserve release tags or digests needed for rollback and investigations.

Edge Cases

• ECR checks are supplemental and should not be counted as CIS AWS Foundations recommendations.
• Repository-level scan-on-push may be absent when registry-level enhanced scanning is enabled; the review should accept registry-level evidence.
• Mutable tags may be acceptable in isolated development repositories with documented exclusions.

Remediation Quality

• Fix resolves the vulnerability
• Fix doesn't introduce new security issues
• Fix doesn't break functionality
• Issues found: Add supplemental ECR evidence gates for tag immutability, scan-on-push/enhanced scanning, repository policy exposure, encryption, lifecycle cleanup, and rollback evidence.

Sources Checked

• AWS ECR image tag mutability: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html
• AWS ECR image scanning: https://docs.aws.amazon.com/en_us/AmazonECR/latest/userguide/image-scanning.html
• AWS ECR enhanced scanning: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced-enabling.html
• Terraform aws_ecr_repository: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository

Bounty Info

• I have read and agree to the CONTRIBUTING.md bounty terms
• Preferred payment method: PayPal or Base USDC; payout details can be provided privately after acceptance.

[lcwLcw123]

/attempt #1204

[lcwLcw123]

Implementation PR submitted: #1228

Bounty requested: Improver Moderate ($100) if accepted.

Summary:

• Added AWS Container Registry Evidence Gates for ECR repositories.
• Added ECR Repository Evidence output fields for tag mutability, scan coverage, enhanced scanning, digest evidence, scan freshness, lifecycle/retention, and findings.
• Added findings classification for mutable production tags, missing scanning, missing digest evidence, and stale scan evidence.
• Extended benchmark-checklist.md with ECR-1 through ECR-4 checks.
• Added fixtures for a benign immutable/enhanced-scanning repository and a vulnerable mutable/unscanned production repository deployed by tag.
• Added official AWS ECR and Inspector references.

Validation performed:

• Red-first marker check failed before edits for the new ECR gate terms.
• Marker checks for ECR Repository Evidence, AWS Container Registry Evidence Gates, image tag mutability, scan-on-push, enhanced scanning, image digest evidence, scan freshness, and lifecycle policy.
• git diff --check
• git diff --cached --check
• Required frontmatter sweep across skills/**/SKILL.md
• Markdown fence balance check for aws-review markdown
• ASCII byte scan for changed and untracked files
• Prompt-injection phrase scan for changed aws-review files
• Official source URL checks returned 200 for AWS ECR tag mutability, AWS ECR image scanning, and Amazon Inspector ECR scanning docs.

Preferred payment method: GitHub Sponsors; PayPal can be provided privately if preferred.