(bootstrap): Enable ECR ScanOnPush by default

[xeroxnir]

Description

Hello,

Enable ScanOnPush (no additional charge) for CDK bootstrap default ECR Registry. See related resource definition

Use Case

Building containers using DockerImageAsset, would be important to have visibility into their security vulnerabilities.

Proposed Solution

    Type: AWS::ECR::Repository
    Properties:
      RepositoryName:
        Fn::If:
          - HasCustomContainerAssetsRepositoryName
          - Fn::Sub: "${ContainerAssetsRepositoryName}"
          - Fn::Sub: cdk-${Qualifier}-container-assets-${AWS::AccountId}-${AWS::Region}
       ImageScanningConfiguration: 
         ScanOnPush: true

Other information

No response

Acknowledge

• I may be able to implement this feature request
• This feature might incur a breaking change

[rix0rrr]

I'd love to do this, before before we do it I have an open question to ECR team if there are any downsides to enabling this feature for everyone. I would like to hear back from them before we move on this.

[Hi-Fi]

Seems that this is closed already with #17994

[jeffshep]

Is there some regression on this feature? It doesn't appear to be in the latest version of the bootstrap CloudFormation file?

[TheRealAmazonKendra]

Removed in #21342

[TheRealAmazonKendra]

Given the comment on that PR about scanning at the repo level being deprecated, is this still a valid issue?

[jeffshep]

From my perspective it felt like an out-of-the-box configuration that should have been enabled. However, given the constraints described about applying this globally in #21342 , I'd agree it doesn't fit here

[madeline-k]

Closing as it looks like this issue is no longer needed. If you think this issue was closed in error, please open a new issue! We will not see any further comments on this one.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.