A company needs to harden its container images before the images are in a running state. The company's application uses Amazon Elastic Container Registry (Amazon ECR) as an image registry. Amazon Elastic Kubernetes Service (Amazon EKS) for compute, and an AWS CodePipeline pipeline that orchestrates a continuous integration and continuous delivery (CI/CD) workflow. Dynamic application security testing occurs in the final stage of the pipeline after a new image is deployed to a development namespace in the EKS cluster. A developer needs to place an analysis stage before this deployment to analyze the container image earlier in the CI/CD pipeline. Which solution will meet these requirements with the MOST operational efficiency?
Select one answer.
Marked answer: B
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose D1
Amazon Q suggest D
Chose B2
C) Eliminated - Scanning the source code directly does not analyze vulnerabilities specific to the container image D) Eliminated - Adding the scan at the deployment stage is too late in the pipeline. It defeats the purpose of early detection and could allow vulnerable images to proceed further in the pipeline before being flagged
Chose B1
B vs D: B: scan before pushing ECR (after the container image is built) D: scan after pushing ECR (before the deployment to the EKS cluster)
