【Security Hub修復手順】[ECR.5] ECR リポジトリはカスタマーマネージド AWS KMS keys で暗号化する必要があります

export AWS_PAGER=""
REGION="ap-northeast-1"

printf "%-30s %-10s %s\n" "REPOSITORY" "TYPE" "KEY_MANAGER"
for r in $(aws ecr describe-repositories --region $REGION --query 'repositories[].repositoryName' --output text); do
  enc=$(aws ecr describe-repositories --repository-names "$r" --region $REGION \
        --query 'repositories[0].encryptionConfiguration.[encryptionType,kmsKey]' --output text)
  type=$(echo "$enc" | awk '{print $1}'); key=$(echo "$enc" | awk '{print $2}')
  if [ "$key" = "None" ]; then mgr="-"; else
    mgr=$(aws kms describe-key --key-id "$key" --region $REGION --query 'KeyMetadata.KeyManager' --output text); fi
  printf "%-30s %-10s %s\n" "$r" "$type" "$mgr"
done

REPOSITORY                     TYPE       KEY_MANAGER
ecr5-default                   AES256     -
ecr5-awsmanaged                KMS        AWS
ecr5-cmk                       KMS        CUSTOMER

aws ecr create-repository \
  --repository-name my-app-encrypted \
  --region $REGION \
  --encryption-configuration encryptionType=KMS,kmsKey=<キーID または キーARN>

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGISTRY="$ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com"
SRC="my-app"
DST="my-app-encrypted"

aws ecr get-login-password --region $REGION | docker login --username AWS --password-stdin $REGISTRY

for tag in $(aws ecr list-images --repository-name $SRC --region $REGION \
             --filter tagStatus=TAGGED --query 'imageIds[].imageTag' --output text); do
  docker pull $REGISTRY/$SRC:$tag
  docker tag $REGISTRY/$SRC:$tag $REGISTRY/$DST:$tag
  docker push $REGISTRY/$DST:$tag
done

SRC="my-app"
TMP="my-app-temp"

# 1. 一時リポジトリへ全タグを退避
aws ecr create-repository --repository-name $TMP --region $REGION
for tag in $(aws ecr list-images --repository-name $SRC --region $REGION \
             --filter tagStatus=TAGGED --query 'imageIds[].imageTag' --output text); do
  docker pull $REGISTRY/$SRC:$tag
  docker tag $REGISTRY/$SRC:$tag $REGISTRY/$TMP:$tag
  docker push $REGISTRY/$TMP:$tag
done

# 2. 退避を確認してから削除し、同名＋カスタマーマネージドキーで再作成
aws ecr list-images --repository-name $TMP --region $REGION --query 'imageIds[].imageTag' --output text
aws ecr delete-repository --repository-name $SRC --force --region $REGION
aws ecr create-repository \
  --repository-name $SRC \
  --region $REGION \
  --encryption-configuration encryptionType=KMS,kmsKey=<キーID または キーARN>

# 3. 書き戻し
for tag in $(aws ecr list-images --repository-name $TMP --region $REGION \
             --filter tagStatus=TAGGED --query 'imageIds[].imageTag' --output text); do
  docker tag $REGISTRY/$TMP:$tag $REGISTRY/$SRC:$tag
  docker push $REGISTRY/$SRC:$tag
done

# 4. 一時リポジトリを削除
aws ecr delete-repository --repository-name $TMP --force --region $REGION