Only trusted, scanned images should reach your nodes, and policy should refuse the rest.

Build

minimal base, non-root, SBOM

→

Push to ECR

immutable tags, scan on push

→

Sign

cosign or AWS Signer

→

Admit

policy engine verifies

→

Run

Pod Security enforced

ECR features

Immutable tags, lifecycle policies, scan on push, replication across regions, pull-through cache for public registries.

Admission policy engines

Kyverno or Gatekeeper can require signed images, trusted registries, resource requests and labels. Start in audit mode, then enforce.

Pin by digest

Tags can move. Deploy by digest, or enforce immutability, so what you scanned is what runs.

Kyverno: allow only our registry

kind: ClusterPolicy
spec:
  validationFailureAction: Audit        # switch to Enforce later
  rules:
  - name: trusted-registry
    match: {any: [{resources: {kinds: [Pod]}}]}
    validate:
      message: images must come from our ECR
      pattern: {spec: {containers: [{image: "111122223333.dkr.ecr.eu-west-1.amazonaws.com/*"}]}}

Images and admission: control what runs

A secure cluster starts before deployment. Build minimal images that run as non-root and publish a software bill of materials. Push to Amazon ECR with immutable tags and scan on push so that vulnerable images are flagged. Sign images (with cosign or AWS Signer) so that you can prove who built them. Reveal the five stages with the right arrow.

At admission time, a policy engine (Kyverno or OPA Gatekeeper) checks every Pod against rules: images must come from your registry, be signed, use digests, define resource requests and not run privileged. Start in audit mode to see what would be rejected, fix the findings, then switch to enforce. Combine with Pod Security Standards labels on namespaces as the baseline.

ECR offers several features that reduce risk and cost: lifecycle policies to remove old images, replication across regions for resilience and faster pulls, and a pull-through cache for public registries so you do not depend on Docker Hub's rate limits at runtime.

Gotcha: scanning is not a gate unless something enforces it. A dashboard of findings does not stop a vulnerable image from running; wire scan results or signatures into CI and admission so that policy, not memory, blocks the bad image.