AWS Certified Solutions Architect – Associate (SAA-C03) — Question 776

A company runs its workloads on Amazon Elastic Container Service (Amazon ECS). The container images that the ECS task definition uses need to be scanned for Common Vulnerabilities and Exposures (CVEs). New container images that are created also need to be scanned.

Which solution will meet these requirements with the FEWEST changes to the workloads?

Answer options

• A. Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the container images. Specify scan on push filters for the ECR basic scan.
• B. Store the container images in an Amazon S3 bucket. Use Amazon Macie to scan the images. Use an S3 Event Notification to initiate a Macie scan for every event with an s3:ObjectCreated:Put event type.
• C. Deploy the workloads to Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository. Specify scan on push filters for the ECR enhanced scan.
• D. Store the container images in an Amazon S3 bucket that has versioning enabled. Configure an S3 Event Notification for s3:ObjectCreated:* events to invoke an AWS Lambda function. Configure the Lambda function to initiate an Amazon Inspector scan.

Correct answer: A

Explanation

Using Amazon Elastic Container Registry (Amazon ECR) with basic scanning enabled on push provides an automated, native way to scan container images for CVEs without modifying the underlying Amazon ECS infrastructure. Migrating to Amazon Elastic Kubernetes Service (Amazon EKS) or using Amazon S3 with AWS Lambda/Amazon Macie would introduce unnecessary complexity and significant architectural changes. Therefore, configuring Amazon ECR basic scan on push requires the fewest changes to the existing workloads.