From 837055155953dbfe9603a35fcdda49f527028eff Mon Sep 17 00:00:00 2001
From: Jonathan Goldwasser <jonathan@goldwasserexchange.be>
Date: Wed, 6 Nov 2019 11:28:24 +0100
Subject: [PATCH 1/2] feat(toolkit): configure image scanning on push

Amazon ECR image scanning helps in identifying software vulnerabilities in container images.
Amazon ECR uses the Common Vulnerabilities and Exposures (CVEs) database from the open source
CoreOS Clair project and provides a list of scan findings.

This feature is available at no additional charge.
---
 packages/aws-cdk/lib/api/toolkit-info.ts | 10 +++-
 packages/aws-cdk/test/test.docker.ts     | 73 +++++++++++++++++++++++-
 2 files changed, 81 insertions(+), 2 deletions(-)

diff --git a/packages/aws-cdk/lib/api/toolkit-info.ts b/packages/aws-cdk/lib/api/toolkit-info.ts
index 726d34ae16596..62120adff3977 100644
--- a/packages/aws-cdk/lib/api/toolkit-info.ts
+++ b/packages/aws-cdk/lib/api/toolkit-info.ts
@@ -143,6 +143,14 @@ export class ToolkitInfo {
       lifecyclePolicyText: JSON.stringify(DEFAULT_REPO_LIFECYCLE)
     }).promise();
 
+    // Activate image scanning on push (helps in identifying software vulnerabilities, no additional charge)
+    await ecr.putImageScanningConfiguration({
+      repositoryName,
+      imageScanningConfiguration: {
+        scanOnPush: true
+      }
+    }).promise();
+
     return {
       repositoryUri: repository.repositoryUri!,
       repositoryName
@@ -244,7 +252,7 @@ function getOutputValue(stack: aws.CloudFormation.Stack, output: string): string
   return result;
 }
 
-const DEFAULT_REPO_LIFECYCLE = {
+export const DEFAULT_REPO_LIFECYCLE = {
   rules: [
     {
       rulePriority: 100,
diff --git a/packages/aws-cdk/test/test.docker.ts b/packages/aws-cdk/test/test.docker.ts
index b187f859a4346..9d877dfa0d619 100644
--- a/packages/aws-cdk/test/test.docker.ts
+++ b/packages/aws-cdk/test/test.docker.ts
@@ -1,7 +1,7 @@
 import cxapi = require('@aws-cdk/cx-api');
 import { Test } from 'nodeunit';
 import sinon = require('sinon');
-import { ToolkitInfo } from '../lib';
+import { DEFAULT_REPO_LIFECYCLE, ToolkitInfo } from '../lib';
 import { prepareContainerAsset } from '../lib/docker';
 import os = require('../lib/os');
 import { MockSDK } from './util/mock-sdk';
@@ -102,6 +102,77 @@ export = {
     test.done();
   },
 
+  async 'configures lifecycle policy and image scanning'(test: Test) {
+    // GIVEN
+    let putLifecyclePolicyParams;
+    let putImageScanningConfigurationParams;
+
+    const sdk = new MockSDK();
+    sdk.stubEcr({
+      describeRepositories() {
+        return { repositories: [] };
+      },
+
+      createRepository() {
+        return {
+          repository: {
+            repositoryUri: 'uri'
+          }
+        };
+      },
+
+      putLifecyclePolicy(params) {
+        putLifecyclePolicyParams = params;
+        return {};
+      },
+
+      putImageScanningConfiguration(params) {
+        putImageScanningConfigurationParams = params;
+
+        // Stop the test so that we don't actually docker build
+        throw new Error('STOPTEST');
+      }
+    });
+
+    const toolkit = new ToolkitInfo({
+      sdk,
+      bucketName: 'BUCKET_NAME',
+      bucketEndpoint: 'BUCKET_ENDPOINT',
+      environment: { name: 'env', account: '1234', region: 'abc' }
+    });
+
+    // WHEN
+    const asset: cxapi.ContainerImageAssetMetadataEntry = {
+      id: 'assetId',
+      imageNameParameter: 'MyParameter',
+      packaging: 'container-image',
+      path: '/foo',
+      repositoryName: 'some-name',
+      sourceHash: '0123456789abcdef',
+    };
+
+    try {
+      await prepareContainerAsset('.', asset, toolkit, false);
+    } catch (e) {
+      if (!/STOPTEST/.test(e.toString())) { throw e; }
+    }
+
+    // THEN
+    test.deepEqual(putLifecyclePolicyParams, {
+      repositoryName: 'some-name',
+      lifecyclePolicyText: JSON.stringify(DEFAULT_REPO_LIFECYCLE)
+    });
+
+    test.deepEqual(putImageScanningConfigurationParams, {
+      repositoryName: 'some-name',
+      imageScanningConfiguration: {
+        scanOnPush: true
+      }
+    });
+
+    test.done();
+  },
+
   async 'passes the correct target to docker build'(test: Test) {
     // GIVEN
     const toolkit = new ToolkitInfo({

From f2be17ce660c98a3cb3a35be408f96ae8ea7c884 Mon Sep 17 00:00:00 2001
From: Jonathan Goldwasser <jonathan@goldwasserexchange.be>
Date: Fri, 8 Nov 2019 10:16:01 +0100
Subject: [PATCH 2/2] dummy change to trigger build

---
 packages/aws-cdk/lib/api/toolkit-info.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/aws-cdk/lib/api/toolkit-info.ts b/packages/aws-cdk/lib/api/toolkit-info.ts
index 62120adff3977..b18d5477039a3 100644
--- a/packages/aws-cdk/lib/api/toolkit-info.ts
+++ b/packages/aws-cdk/lib/api/toolkit-info.ts
@@ -143,7 +143,7 @@ export class ToolkitInfo {
       lifecyclePolicyText: JSON.stringify(DEFAULT_REPO_LIFECYCLE)
     }).promise();
 
-    // Activate image scanning on push (helps in identifying software vulnerabilities, no additional charge)
+    // Configure image scanning on push (helps in identifying software vulnerabilities, no additional charge)
     await ecr.putImageScanningConfiguration({
       repositoryName,
       imageScanningConfiguration: {