How do I resolve the UNSUPPORTED_IMAGE status for my scan in Amazon ECR?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Determine the cause of the UNSUPPORTED_IMAGE status

Use the following methods to identify why your image received the UNSUPPORTED_IMAGE status:

Verify the media type for the image

To review the media types that Amazon Inspector supports for Amazon ECR scanning, see Supported operating systems and media types.

To check the media type of your image, run the following batch-get-image AWS CLI command:

aws ecr batch-get-image \
    --repository-name REPOSITORY_NAME \
    --image-ids imageTag=IMAGE_TAG \
    --region REGION \
    --output json

Note: Replace REPOSITORY_NAME with your repository name, IMAGE_TAG with your image tag, and REGION with your AWS Region.

In the output, check that the mediaType field has a supported media type. If the media type isn't in the supported list, then Amazon ECR can't scan the image. To resolve this, see the Rebuild the image with a supported format section in this article.

Note: Amazon Inspector doesn't support multi-architecture manifest lists, such as application/vnd.docker.distribution.manifest.list.v2+json, for Amazon ECR scanning.

Check the image scan findings

To view the scan status and findings for your image, run the following describe-image-scan-findings AWS CLI command:

aws ecr describe-image-scan-findings \
    --repository-name YOUR_REPOSITORY \
    --image-id imageTag=YOUR_TAG \
    --region REGION

Note: Replace YOUR_REPOSITORY with your repository name, YOUR_TAG with your image tag, and REGION with your Region.

Then, review the imageScanStatus field in the output. The description field provides details about why the image isn't supported.

Check the image coverage status in Amazon Inspector

If you use Amazon Inspector enhanced scanning, then complete the following steps to check the coverage status for your image:

1. Open the Amazon Inspector console.
2. In the navigation pane, choose Account management.
3. Choose the Container images tab.
4. Find your image, and then review the Coverage status column.

If the status shows Not covered with a reason of UNSUPPORTED_IMAGE, then the image uses an unsupported format.

To use the AWS CLI to check coverage, run the following list-coverage command:

aws inspector2 list-coverage \
    --filter-criteria '{"resourceType":[{"comparison":"EQUALS","value":"AWS_ECR_CONTAINER_IMAGE"}],"ecrRepositoryName":[{"comparison":"EQUALS","value":"YOUR_REPOSITORY"}]}' \
    --region REGION

Note: Replace YOUR_REPOSITORY with your repository name and REGION with your Region.

Confirm that the image doesn't have an archived status

Amazon Inspector doesn't scan container images that have an archived status in Amazon ECR.

To check the image status, run the following describe-images AWS CLI command:

aws ecr describe-images \
    --repository-name YOUR_REPOSITORY \
    --image-ids imageTag=YOUR_TAG \
    --region REGION

Note: Replace YOUR_REPOSITORY with your repository name, YOUR_TAG with your image tag, and REGION with your Region.

If the image has an archived status, then restore the image to active status to allow scanning.

Rebuild the image with a supported format

If your image uses an unsupported media type, then rebuild the image with a supported format. Use Docker or a compatible build tool that produces images with supported manifest types.

Complete the following steps:

1. Confirm that your build tool outputs images with a supported manifest type.
2. Push the rebuilt image to your Amazon ECR repository.
   Note: If you use a multi-architecture image with a manifest list such as application/vnd.docker.distribution.manifest.list.v2+json, then push individual platform-specific images instead. Amazon Inspector scans individual image manifests, not manifest lists.
3. Confirm that the new image scan is successful.

Related information

Scanning Amazon ECR container images with Amazon Inspector

Scan images for software vulnerabilities in Amazon ECR

Supported operating systems and programming languages for Amazon Inspector