3 ms·
any chance you could expand on this? "I know it seems like a lot of tools, but most of them are set up once and forget. Except for the occasional round of depe
by Wheaties466 6y ago
any chance you could expand on this?
"I know it seems like a lot of tools, but most of them are set up once and forget. Except for the occasional round of dependency updates. But even for that I have automated dependency/container scanning to detect vulnerabilities, and get notified if updating an image is recommended."
- amzans 6y agoRegarding docker images, I use the image scanning feature of ECR: https://aws.amazon.com/blogs/containers/amazon-ecr-native-container-image-scanning/ https://aws.amazon.com/blogs/containers/amazon-ecr-native-co... The docs make it look really complicated, but it comes down to enabling the service on the Terraform config. Also for app dependencies, I use bots to open PRs on my repo whenever an important security fix is published for one of my dependencies.