Update ECR image scanning configuration to be optional for Pattern-2 Lambda containers

Author: Bob Strahan

patterns/pattern-2/template.yaml

@@ -110,6 +110,12 @@ Parameters:
     AllowedValues: ['true', 'false']
     Description: Enable X-Ray tracing
 
+  EnableECRImageScanning:
+    Type: String
+    Default: 'true'
+    AllowedValues: ['true', 'false']
+    Description: Enable automatic vulnerability scanning for Lambda container images in ECR
+
   PermissionsBoundaryArn:
     Type: String
     Default: ""
@@ -147,6 +153,7 @@ Conditions:
     !Not [!Equals [!Ref CustomExtractionModelARN, ""]]
   HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundaryArn, ""]]
   HasAppSyncApi: !Not [!Equals [!Ref AppSyncApiArn, ""]]
+  IsECRImageScanningEnabled: !Equals [!Ref EnableECRImageScanning, "true"]
 
 Resources:
   Pattern2DockerBuildRole:
@@ -223,7 +230,7 @@ Resources:
     # checkov:skip=CKV_AWS_51: "Mutable tags allowed for workflow flexibility and version updates."
     Properties:
       ImageScanningConfiguration:
-        ScanOnPush: true
+        ScanOnPush: !If [IsECRImageScanningEnabled, true, false]
       EncryptionConfiguration:
         EncryptionType: KMS
         KmsKey: !Ref CustomerManagedEncryptionKeyArn

template.yaml

@@ -328,6 +328,17 @@ Parameters:
     AllowedPattern: "^(|arn:aws[a-z-]*:iam::[0-9]{12}:policy/.+)$"
     ConstraintDescription: Must be empty or a valid IAM policy ARN
 
+  EnablePattern2ECRImageScanning:
+    Type: String
+    Default: "true"
+    AllowedValues:
+      - "true"
+      - "false"
+    Description: >-
+      Enable automatic vulnerability scanning for Pattern-2 Lambda container images in ECR. 
+      Disabling may improve deployment reliability but reduces security posture. 
+      Recommended: true for production, false only if experiencing deployment issues.
+
   # Logging configuration
   LogLevel:
     Type: String
@@ -960,6 +971,7 @@ Resources:
         ArtifactPrefix: "<ARTIFACT_PREFIX_TOKEN>"
         Pattern2SourceZipfile: "<PATTERN2_SOURCE_ZIPFILE_TOKEN>"
         EvaluationFunctionArn: !GetAtt EvaluationFunction.Arn
+        EnableECRImageScanning: !Ref EnablePattern2ECRImageScanning
 
   PATTERN3STACK:
     DependsOn: