WAF-SEC-070 – Vulnerability & Patch Management

Säule: Security | Schweregrad: Mittel | Kategorie: Container Security | Automatisierbar: High

Beschreibung

All container images MUST have vulnerability scanning enabled at the registry level using enhanced scanning (Amazon Inspector) or equivalent. Container images containing critical or high CVEs MUST NOT be deployed to production environments without a documented exception and compensating control. ECR repositories MUST use immutable tags to prevent image tampering after push. A documented patch management process MUST exist with defined SLAs: critical CVEs remediated within 72 hours, high CVEs within 7 days, medium within 30 days. OS-level patching for EC2 instances and EKS nodes MUST be automated via AWS Systems Manager Patch Manager.

Begründung

Risiko	Beschreibung
Risk	Unscanned container images frequently contain known vulnerabilities exploitable in production.
Risk	Missing SBOMs and scan results complicate supply-chain audits and incident response.

Risiko

Beschreibung

Risk

Unscanned container images frequently contain known vulnerabilities exploitable in production.

Risk

Missing SBOMs and scan results complicate supply-chain audits and incident response.

Anforderungen

All container images MUST have vulnerability scanning enabled at the registry level using enhanced scanning (Amazon Inspector) or equivalent.
Container images containing critical or high CVEs MUST NOT be deployed to production environments without a documented exception and compensating control.
ECR repositories MUST use immutable tags to prevent image tampering after push.
A documented patch management process MUST exist with defined SLAs: critical CVEs remediated within 72 hours, high CVEs within 7 days, medium within 30 days.
OS-level patching for EC2 instances and EKS nodes MUST be automated via AWS Systems Manager Patch Manager.

Implementierungsleitfaden

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).
Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level	Name	Kriterien
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Kriterien

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sec-070.tf.aws.ecr-image-scanning

Engine: terraform | Provider: aws | Automated: Ja

ECR repositories must have image scanning enabled

All aws_ecr_repository resources must have an image_scanning_configuration block with scan_on_push = true to ensure every pushed image is immediately scanned for known vulnerabilities.

Scope: resource — aws_ecr_repository

Assertions: * image_scanning_configuration attribute exists — ECR repository must have image_scanning_configuration block defined with scan_on_push = true.

Remediation: Add an image_scanning_configuration block to all aws_ecr_repository resources:\n image_scanning_configuration { scan_on_push = true }\nFor enhanced scanning, enable Amazon Inspector at the account level and configure continuous ECR scanning via aws_inspector2_enabler resource.

Compliant

resource "aws_ecr_repository" "app" {
  name                 = "my-application"
  image_tag_mutability = "IMMUTABLE"
  image_scanning_configuration {
    scan_on_push = true
  }
  encryption_configuration {
    encryption_type = "KMS"
    kms_key         = aws_kms_key.ecr.arn
  }
}

Non-Compliant

resource "aws_ecr_repository" "app" {
  name = "my-application"
  # image_scanning_configuration not set – WAF-SEC-070 violation
  # image_tag_mutability defaults to MUTABLE – WAF-SEC-070 violation
}

waf-sec-070.tf.aws.ecr-immutable-tags

Engine: terraform | Provider: aws | Automated: Ja

ECR repositories must use immutable image tags

All aws_ecr_repository resources must have image_tag_mutability = 'IMMUTABLE' to prevent overwriting of existing image tags, which could allow supply chain attacks by replacing a trusted image with a malicious one.

Scope: resource — aws_ecr_repository

Assertions: * image_tag_mutability equals IMMUTABLE — ECR repository MUST use immutable tags (image_tag_mutability = 'IMMUTABLE') to prevent image tampering.

Remediation: Set image_tag_mutability = "IMMUTABLE" on all aws_ecr_repository resources. Update deployment pipelines to reference images by digest (sha256:…) rather than mutable tags like 'latest'. Implement a tagging strategy using semantic versioning (e.g., v1.2.3) combined with immutability for full traceability.

Compliant

resource "aws_ecr_repository" "app" {
  name                 = "my-application"
  image_tag_mutability = "IMMUTABLE"
  image_scanning_configuration {
    scan_on_push = true
  }
}

Non-Compliant

resource "aws_ecr_repository" "app" {
  name                 = "my-application"
  image_tag_mutability = "MUTABLE"  # WAF-SEC-070 violation: allows tag overwrite
}

waf-sec-070.config.azurerm.azurerm-container-security

Engine: config | Provider: azurerm | Automated: Ja

Azure Container Registry vulnerability scanning must be enabled

A version-controlled policy document must exist at docs/security/waf-sec-070-azurerm-container-security.md and document the Azure implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-070-azurerm-container-security.md

Remediation: Create or update docs/security/waf-sec-070-azurerm-container-security.md. State the requirement, how it is implemented for Azure, the review cadence, and the owner.

Compliant

docs/security/waf-sec-070-azurerm-container-security.md:
- The Azure implementation of WAF-SEC-070 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-070-azurerm-container-security.md` is missing or does not contain a normative requirement.
# WAF-SEC-070 violation: Azure control is not documented

waf-sec-070.config.google.google-container-security

Engine: config | Provider: google | Automated: Ja

Google Artifact Registry images must be scanned for vulnerabilities

A version-controlled policy document must exist at docs/security/waf-sec-070-google-container-security.md and document the GCP implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-070-google-container-security.md

Remediation: Create or update docs/security/waf-sec-070-google-container-security.md. State the requirement, how it is implemented for GCP, the review cadence, and the owner.

Compliant

docs/security/waf-sec-070-google-container-security.md:
- The GCP implementation of WAF-SEC-070 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-070-google-container-security.md` is missing or does not contain a normative requirement.
# WAF-SEC-070 violation: GCP control is not documented

waf-sec-070.config.stackit.stackit-container-security

Engine: config | Provider: stackit | Automated: Ja

STACKIT Container Registry images must be scanned for vulnerabilities

A version-controlled policy document must exist at docs/security/waf-sec-070-stackit-container-security.md and document the STACKIT implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-070-stackit-container-security.md

Remediation: Create or update docs/security/waf-sec-070-stackit-container-security.md. State the requirement, how it is implemented for STACKIT, the review cadence, and the owner.

Compliant

docs/security/waf-sec-070-stackit-container-security.md:
- The STACKIT implementation of WAF-SEC-070 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-070-stackit-container-security.md` is missing or does not contain a normative requirement.
# WAF-SEC-070 violation: STACKIT control is not documented

waf-sec-070.config.ovh.ovh-container-security

Engine: config | Provider: ovh | Automated: Ja

OVHcloud container workloads must scan images for vulnerabilities

A version-controlled policy document must exist at docs/security/waf-sec-070-ovh-container-security.md and document the OVHcloud implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-070-ovh-container-security.md

Remediation: Create or update docs/security/waf-sec-070-ovh-container-security.md. State the requirement, how it is implemented for OVHcloud, the review cadence, and the owner.

Compliant

docs/security/waf-sec-070-ovh-container-security.md:
- The OVHcloud implementation of WAF-SEC-070 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-070-ovh-container-security.md` is missing or does not contain a normative requirement.
# WAF-SEC-070 violation: OVHcloud control is not documented

waf-sec-070.config.hcloud.hcloud-container-security

Engine: config | Provider: hcloud | Automated: Ja

Hetzner Cloud container workloads must scan images for vulnerabilities

A version-controlled policy document must exist at docs/security/waf-sec-070-hcloud-container-security.md and document the Hetzner Cloud implementation of this control. The checker validates that the file exists and contains a normative requirement statement (MUST/SHALL/required/mandatory).

Scope: file — docs/security/waf-sec-070-hcloud-container-security.md

Remediation: Create or update docs/security/waf-sec-070-hcloud-container-security.md. State the requirement, how it is implemented for Hetzner Cloud, the review cadence, and the owner.

Compliant

docs/security/waf-sec-070-hcloud-container-security.md:
- The Hetzner Cloud implementation of WAF-SEC-070 is documented.
- Implementation status and owner are recorded.
- Review cadence is defined (e.g. quarterly).

Non-Compliant

# `docs/security/waf-sec-070-hcloud-container-security.md` is missing or does not contain a normative requirement.
# WAF-SEC-070 violation: Hetzner Cloud control is not documented

Evidenz

Art Erforderlich Beschreibung

Art	Erforderlich	Beschreibung
`iac`	Erforderlich	Terraform configuration implementing the control.
`governance`	Erforderlich	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Erforderlich

Terraform configuration implementing the control.

governance

Erforderlich

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

WAF-SEC-070 – Vulnerability & Patch Management

Beschreibung

Begründung

Anforderungen

Implementierungsleitfaden

Reifegrade

Checks

waf-sec-070.tf.aws.ecr-image-scanning

waf-sec-070.tf.aws.ecr-immutable-tags

waf-sec-070.config.azurerm.azurerm-container-security

waf-sec-070.config.google.google-container-security

waf-sec-070.config.stackit.stackit-container-security

waf-sec-070.config.ovh.ovh-container-security

waf-sec-070.config.hcloud.hcloud-container-security

Evidenz

Verwandte Controls