Artifact Registry Security and Dependency Scanning

Artifact registries store build artifacts, container images, and packages. Securing these registries and scanning dependencies prevents supply chain attacks and ensures only trusted artifacts reach production.

Private Registry Setup

resource "aws_ecr_repository" "app" {
  name                 = "app"
  image_tag_mutability = "IMMUTABLE"
  image_scanning_configuration {
    scan_on_push = true
  }
}

Dependency Scanning

# Snyk for dependencies
snyk test --severity-threshold=high

# npm audit
npm audit --audit-level=high

# pip-audit for Python
pip-audit --strict

JFrog Xray Integration

# Scan artifacts in Artifactory
jfrog xr scan --watches production-watch

Implement vulnerability policies that block deployment of artifacts with critical vulnerabilities.