(aws-cdk): (CDK generates ECR repositories that don't adhere to Security Hub compliance packs)

[meghannoelle]

Describe the bug

CDK provisioned ECR repositories cause the following finding in Security Hub:
ECR.2 ECR private repositories should have tag immutability configured
(https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#ecr-2-remediation)

Expected Behavior

I expected CDK-provisioned ECR repositories to have tag immutability configured by default.

Current Behavior

CDK-provisioned ECR repositories don't have tag immutability configured and are breaching Security Hub's AWS foundational security best practices.

Reproduction Steps

Deploy an ECR repo and note the new security finding in Security Hub.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.35.0 (build 5c23578)

Framework Version

No response

Node.js Version

v14.18.1

OS

MacOS

Language

Typescript

Language Version

No response

Other information

No response

[peterwoodworth]

We don't necessarily support Security Hub guidelines by default. Here's some discussion around potential way we may be able to accomplish this in the future easily, but for now you can configure this with imageTagMutability prop

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.