ScanOnPush

ScanOnPush configuration at the repository level is deprecated in favor of registry level scan filters.

resource "aws_ecr_repository" "your-app" {
 name                 = "your-app"
 image_tag_mutability = "MUTABLE"

 image_scanning_configuration {
   scan_on_push = true
 }
}

See also

• ECR: aws ecr [ get-login | get-login-password | describe-repositories | list-images | describe-images | create-repository | start-image-scan | describe-image-scan-findings | batch-get-image | put-image ]