core: ContainerAssetsRepository fails security controls from cdk bootstrap

[gricey432]

Describe the bug

The ECR repository made during bootstrap doesn't have image scanning enabled [1]. This causes SecurityHub to mark it as failing ECR.1 [2]

[1] https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L234

[2] https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html#ecr-1

Expected Behavior

SecurityHub doesn't find issues

Current Behavior

SecurityHub finds issues

Reproduction Steps

Bootstrap an account with SecurityHub enabled. You don't seem to need to push anything to the repository (mine is empty).

Possible Solution

The AWS::ECR::Repository should gain ImageScanningConfiguration. I believe basic image scanning is free

Additional Information/Context

No response

CDK CLI Version

2.81.0 (build bd920f2)

Framework Version

No response

Node.js Version

v16.10.0

OS

Windows 11

Language

Typescript

Language Version

No response

Other information

No response

[pahud]

Yes it makes sense! Making it p1 feature request.

[pahud]

Hi

We used to have this feature but removed it. Please check this PR description:
#21342

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[gricey432]

Commenting to keep this alive until I return from leave.

I think the linked PR is the right move, I just want to confirm one detail

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.