Inspector2 EventBridge detail.repository-name now includes image digest. Expected change or payload regression?

Question

I am seeing what appears to be a change in the Amazon Inspector2 EventBridge payload for enhanced ECR image scan completion events.

We have an EventBridge rule that listens for Inspector2 scan completion events. This worked until approximately the end of May 2026, where the output matched the [documented Inspector2 scan event shape](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced-events.html), where `detail.repository-name` contained the ECR repository ARN only:

```
{
    "version": "0",
    "id": "739c0d3c-4f02-85c7-5a88-94a9EXAMPLE",
    "detail-type": "Inspector2 Scan",
    "source": "aws.inspector2",
    "account": "123456789012",
    "time": "2021-12-03T18:03:16Z",
    "region": "us-east-2",
    "resources": [
        "arn:aws:ecr:us-east-2:123456789012:repository/amazon/amazon-ecs-sample"
    ],
    "detail": {
        "scan-status": "INITIAL_SCAN_COMPLETE",
        "repository-name": "arn:aws:ecr:us-east-2:123456789012:repository/amazon/amazon-ecs-sample",
        "finding-severity-counts": {
            "CRITICAL": 7,
            "HIGH": 61,
            "MEDIUM": 62,
            "TOTAL": 158
        },
        "image-digest": "sha256:36c7b282abd0186e01419f2e58743e1bf635808231049bbc9d77e5EXAMPLE",
        "image-tags": [
            "latest"
        ]
    }
}
```

An example of the previous working payload shape for my application:

```
{
  "version": "0",
  "id": "b8f2c7a1-43de-91b5-a6f0-2c9d7e4a8f31",
  "detail-type": "Inspector2 Scan",
  "source": "aws.inspector2",
  "account": "123456789012",
  "time": "2026-05-26T16:59:34Z",
  "region": "ca-central-1",
  "resources": [
    "arn:aws:ecr:ca-central-1:123456789012:repository/example-webhooks"
  ],
  "detail": {
    "scan-status": "INITIAL_SCAN_COMPLETE",
    "repository-name": "arn:aws:ecr:ca-central-1:123456789012:repository/example-webhooks",
    "finding-severity-counts": {
      "CRITICAL": 2,
      "HIGH": 5,
      "MEDIUM": 2,
      "TOTAL": 18
    },
    "image-digest": "sha256:8c91f2a7d4e0b6c3f5a29d77e18b4c09aa6f5d2e3b7c8041f9a62c5d0e3b1a44",
    "image-tags": [
      "develop-b7e41c92a6f9d308c4a21e55d79f0ab6123c8d44"
    ],
    "version": "1.0"
  }
}
```

However, recent live events now appear to include the image digest appended to both `resources` and `detail.repository-name`.

Example of the new payload:

```
{
  "version": "0",
  "id": "c7a4e9b2-58fd-40c1-9e6a-3b8f2d91a745",
  "detail-type": "Inspector2 Scan",
  "source": "aws.inspector2",
  "account": "123456789012",
  "time": "2026-06-11T13:53:10Z",
  "region": "ca-central-1",
  "resources": [
    "arn:aws:ecr:ca-central-1:123456789012:repository/example-infra-aspnet/sha256:4f6a0c9e12d8b77a35c1e90f6b2d4a88c7e5f1039ab6d2c4e8f01a5b7c9d3e22"
  ],
  "detail": {
    "scan-status": "INITIAL_SCAN_COMPLETE",
    "repository-name": "arn:aws:ecr:ca-central-1:123456789012:repository/example-infra-aspnet/sha256:4f6a0c9e12d8b77a35c1e90f6b2d4a88c7e5f1039ab6d2c4e8f01a5b7c9d3e22",
    "finding-severity-counts": {
      "CRITICAL": 0,
      "HIGH": 3,
      "MEDIUM": 2,
      "TOTAL": 5
    },
    "image-digest": "sha256:4f6a0c9e12d8b77a35c1e90f6b2d4a88c7e5f1039ab6d2c4e8f01a5b7c9d3e22",
    "image-tags": [
      "latest",
      "9a7f2d1c-4b83-42ef-a901-6c5d8e31f0ab"
    ],
    "version": "1.0"
  }
}
```

This caused our EventBridge rule to stop matching, because the value of `detail.repository-name` is no longer the repository name. It is now effectively an image-specific identifier. My understanding per the documentation is that `detail.repository-name` should identify the repository, not the repository plus image digest. The digest is already available separately in `detail.image-digest`.

Questions:

1. Is this new payload shape expected behaviour for Inspector2 enhanced ECR scan completion events?
2. Is `detail.repository-name` now expected to include the image digest?
3. If so, is there a stable field AWS recommends using for repository-level EventBridge filtering?
4. Was this change documented anywhere?
5. If this is not expected behaviour, can this be confirmed as a regression in the Inspector2/EventBridge event payload?

The impact is that EventBridge rules built against the documented detail.repository-name value silently stopped matching, despite no rule or code changes on our side.

Riku_Kobayashi · Accepted Answer

Hello.

> Is this new payload shape expected behaviour for Inspector2 enhanced ECR scan completion events?  
> Is detail.repository-name now expected to include the image digest?

I searched through AWS documentation and recent update information, but I couldn't find any mention of image digests being included.  
It's unclear whether this behavior will become commonplace in the future, but as a temporary workaround, how about trying the "Prefix matching" rule in EventBridge?  
https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-create-pattern-operators.html  
```
{
  "source": ["aws.inspector2"],
  "detail-type": ["Inspector2 Scan"],
  "detail": {
    "scan-status": ["INITIAL_SCAN_COMPLETE"],
    "repository-name": [
      "arn:aws:ecr:ca-central-1:123456789012:repository/example-infra-aspnet",
      {
        "prefix": "arn:aws:ecr:ca-central-1:123456789012:repository/example-infra-aspnet/sha256:"
      }
    ]
  }
}
```

Inspector2 EventBridge detail.repository-name now includes image digest. Expected change or payload regression?

Add your answer

Relevant content