What is the difference between ECR basic and enhanced scanning, and when do you use each?
⚡
Quick Answer
Basic scanning is Clair-based, runs on push (or manually), and covers OS-package CVEs only — free and simple.
Detailed Answer
Basic scanning is Clair-based, runs on push (or manually), and covers OS-package CVEs only — free and simple. Enhanced scanning is powered by Amazon Inspector: it continuously rescans existing images as new CVEs are published and additionally covers language/application dependencies, so an image that was clean last month gets re-flagged when a new CVE drops. Use enhanced for anything running in production; basic is fine for throwaway or dev repos.
Code Example
# Deep-dive: AWS ECR Image Scanning # basic scanning (Clair-based, on push) vs enhanced scanning (Inspector-backed, continuous), scan-on-push configuration, filtering findings by severity, lifecycle policies to expire vulnerable tags, and gating a deploy on scan results # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
💡
Interview Tip
This is where depth shows — be concrete about AWS ECR Image Scanning, not generic about "security".
ecrdevsecopsdeep-dive