Amazon Inspector doesn't show ECR container critical package issues under "Critical findings"

Question

Hi,

We've an odd issue with Amazon inspector.

Recently we've pushed multiple Docker images into private ECR repositories, and we're scanning them with "Enhanced scanning" and "Continuously scan all repositories" - we have no scanning overrides on individual repositories and no suppression rules; our "*" filter is actively scanning all images.
The scan results appear fine in ECR if you select a repository then click the "See findings" link under "Vulnerabilities" - we see critical package vulnerabilities.

However: in Inspector, the "Critical findings" panel of the dashboard always displays "0 Critical" under "ECR Container".
It also doesn't show the critical issue findings if you filter "By container image" or "By repository" - nothing.
But: if you select "All findings" the critical ECR package issues are visible...

We had thought this might be some sort of dashboard update issue, but it's been like that for over 12 hours now.
What do we need to do to get our scanned critical ECR image vulnerabilities reported on the main Inspector dashboard stats?

Thanks.

[Dashboard Findings: Criticals 0](https://ibb.co/ZcNBFm3)

[Container Image Findings: Empty](https://ibb.co/Zgtg5NZ)

[All Findings - Criticals present and correct](https://ibb.co/NTw8vpX)

AWS-User-5399631 · Answer

I really think Inspector is just broken in our account - I've now noticed it's also not categorising a handful of Critical EC2 issues on the main dashboard too, so it's not just ECR image Criticals it's ignoring.

Out of desperation, I just disabled it, deleted the service role it had created, and re-enabled it (letting it recreate the service role).

Same result: 0 Critical findings on the dashboard pan el, even though when you click on the "0 Critical" it opens up to display all of the actual Critical vulnerabilities that are there.  This is a big problem for us as we use a third party integration that queries Inspector and, at the moment, its main status is informing it that "Everything is OK", when it isn't...

What can we do to resolve this?

Jlacroix · Answer

Hi,

We have the same issue here. Did you find a solution to your situation?

Thanks,

Jlacroix · Answer

On our side, the situation is fixed, but we did nothing to resolve. Sorry,I can't help on how to fix, I have no clue.

Richard Kang · Answer

We having issues with false negative, have you found any solution to this?

Amazon Inspector doesn't show ECR container critical package issues under "Critical findings"

Relevant content