Reading Vunerablities Report in ECR and sign the image

[konthamvivek]

Question

Docker Images are hosted in Elastic container registry in AWS and image scanning is enabled in container registry where i can get vunerablities report of docker image , i need to sign the docker image with the vulnerabilities report (if vunerablities are high and critical the image should not sign ) . can we do the vunerablities check validating with a policy and sign the image using cosign?

[dlorenc]

Hey! This might be a better question for slack. This is definitely possible, but the right approach will vary depending on your build system and security scanner. Can you ask in there and we can help out?

[dlorenc]

Discussed in slack, closing!