4.6Registry Scanning: Continuous Protection

Build-time scanning is necessary but not sufficient. New CVEs are disclosed daily, and an image that was clean yesterday may be vulnerable today. Registry scanning catches this drift.

Scanning Strategies

Strategy	When	Tool
Build-time scan	Every CI build	Trivy, Grype, Snyk
Registry scan	Daily / on push	Harbor, ECR scanning, Trivy operator
Runtime scan	Continuous	Falco, Sysdig, Aqua
SBOM audit	On new CVE disclosure	Grype against stored SBOMs

AWS ECR Scanning

# Enable enhanced scanning on ECR repository
aws ecr put-image-scanning-configuration \
  --repository-name myapp \
  --image-scanning-configuration scanOnPush=true

# Check scan results
aws ecr describe-image-scan-findings \
  --repository-name myapp \
  --image-id imageDigest=sha256:abc123

Harbor Registry Scanning

# Harbor automatically scans on push and can block vulnerable images
# Configuration in Harbor UI or API:
# - Scan on push: enabled
# - Prevent vulnerable images from running:
#   severity threshold: High
# - Auto-scan schedule: daily at 02:00 UTC