# dockerScan

This step scans an ECR image for security vulnerabilities.

## Parameters

| Name                     | Description                                                               | Type      | Default                                                                    | Required |
|--------------------------|---------------------------------------------------------------------------|-----------|----------------------------------------------------------------------------|----------|
| awsRegion                | The AWS region in which the ECR repository is located                     | `String`  | n/a                                                                        | yes      |
| imageName                | The name of the image to scan                                             | `String`  | n/a                                                                        | yes      |
| imageTag                 | The tag of the image to scan                                              | `String`  | n/a                                                                        | yes      |
| ecrAccountId             | The AWS account ID of the account in which the ECR repository is located. | `String`  | n/a                                                                        | yes      |
| awsRoleName              | The IAM role responsible for conducting scans on the ECR.                 | `String`  | `ecr-scan-role`                                                            | no       |
| failBuild                | Whether or not to fail the build if the scan fails.                       | `boolean` | `true`                                                                     | no       |
| vulnerabilitiesToIgnore  | A list of vulnerability IDs to ignore findings for.                       | `List`    | `[]`                                                                       | no       |
| slackNotificationChannel | The slack channel.                                                        | `String`  | n/a                                                                        | no       |
| scannerImage             | The Docker image to use for scanning                                      | `String`  | `086679231553.dkr.ecr.us-east-1.amazonaws.com/docker-image-scanner:latest` | no       |

## Findings output

The scanner container is passed a `FINDINGS_OUTPUT_FILE` environment variable (set to `output/findings.txt`) and expected to write its findings to that file. The `output` directory is mounted from the workspace so the findings are readable afterwards. When the scan fails or completes with warnings, the contents of this file are appended to the resulting build error message.