Amazon ECR Integration

Overview

The Amazon ECR (Elastic Container Registry) integration allows Backline to analyze your container images for security vulnerabilities.

What You Can Do

With the ECR integration, Backline can:

Analyze image layers for vulnerabilities
Detect security issues in dependencies
Track image security across versions
Monitor compliance with security policies

Prerequisites

Before connecting ECR, ensure you have:

An AWS account with ECR repositories
Permissions to deploy CloudFormation stacks (requires IAM role creation)
Your 12-digit AWS Account ID

Connecting ECR

Go to Integration Hub

Navigate to Integrations from the main menu.

Select ECR

Find and click on the Amazon ECR integration card.

Deploy CloudFormation Stack

Click the CloudFormation link in Backline or use the direct link below to deploy the integration role in your AWS account:Deploy CloudFormation StackEnter a unique External ID when prompted. This value secures the cross-account trust relationship.

Get Stack Outputs

After the stack completes, go to the Outputs tab and copy the Role ARN and External ID.

Enter Integration Details

In Backline, enter:

Account ID: Your 12-digit AWS account ID
External ID: The value you provided during stack creation
Role ARN: The ARN from the CloudFormation outputs

Test Connection

Click Test Connection to verify the role can be assumed.

Save

Click Save to complete the integration.

Alternative: Manual Role Creation

If you cannot use CloudFormation or prefer to create IAM resources manually, follow these steps:

We recommend using the CloudFormation template for easier setup and maintenance. Use manual creation only if CloudFormation is not an option in your environment.

Create the IAM Role

In the AWS IAM Console, create a new role named BacklineECRIntegrationRole with the following trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::198331734661:role/BacklineIntegrationReadOnlyECR"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<YOUR_EXTERNAL_ID>"
        }
      }
    }
  ]
}

Replace <YOUR_EXTERNAL_ID> with a unique, secure string of at least 8 characters. Save this value—you’ll need it when configuring Backline.

Attach the Permissions Policy

Create and attach an inline policy named CustomerECRReadPolicy with the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ecr:GetAuthorizationToken",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:DescribeImages",
        "ecr:ListImages"
      ],
      "Resource": "arn:aws:ecr:*:<YOUR_ACCOUNT_ID>:repository/*"
    }
  ]
}

Replace <YOUR_ACCOUNT_ID> with your 12-digit AWS account ID.

Copy the Role ARN

After creating the role, copy its ARN from the role summary page. It will look like:arn:aws:iam::<YOUR_ACCOUNT_ID>:role/BacklineECRIntegrationRole

Complete Integration in Backline

Return to the Enter Integration Details step above and enter your Account ID, External ID, and Role ARN.

Required IAM Permissions

The CloudFormation template creates a role with the following permissions:

ecr:GetAuthorizationToken    (Resource: *)
ecr:BatchGetImage            (Resource: arn:aws:ecr:${Region}:${AccountId}:repository/*)
ecr:GetDownloadUrlForLayer   (Resource: arn:aws:ecr:${Region}:${AccountId}:repository/*)
ecr:DescribeImages           (Resource: arn:aws:ecr:${Region}:${AccountId}:repository/*)
ecr:ListImages               (Resource: arn:aws:ecr:${Region}:${AccountId}:repository/*)

The CloudFormation template follows the principle of least privilege, granting read-only access scoped to ECR repositories in your account.

Security Model

Backline uses secure cross-account role assumption to access your ECR:

Backline assumes its own integration role
That role then assumes the BacklineECRIntegrationRole in your account
The External ID prevents unauthorized access (confused deputy protection)

Backline never stores long-term AWS credentials. All access uses temporary STS tokens that automatically expire.

After Connection

Once ECR is connected, Backline will:

Discover your ECR repositories
Begin scanning container images
Identify vulnerabilities in image layers
Generate remediation recommendations

Image Scanning

Backline scans:

All tagged images in connected repositories
Base image vulnerabilities
Package and dependency vulnerabilities within containers
Configuration issues

Large images may take several minutes to scan initially. Subsequent scans are incremental and faster.

Managing the Integration

Updating Configuration

To update the integration settings:

Open the Integration Hub
Click on the ECR integration
Update the Account ID, External ID, or Role ARN as needed
Test and save

Disconnecting

To remove the ECR integration:

Go to the Integration Hub
Click on the ECR integration
Select Disconnect
Confirm your choice

Disconnecting will stop container image scanning. Existing vulnerability data will remain but won’t be updated.

Additional Configuration

More detailed configuration options will be available here.

Get Started

Settings

Integrations

Overview

What You Can Do

Prerequisites

Connecting ECR

Alternative: Manual Role Creation

Required IAM Permissions

Security Model

After Connection

Image Scanning

Managing the Integration

Updating Configuration

Disconnecting

Additional Configuration

​Overview

​What You Can Do

​Prerequisites

​Connecting ECR

​Alternative: Manual Role Creation

​Required IAM Permissions

​Security Model

​After Connection

​Image Scanning

​Managing the Integration

​Updating Configuration

​Disconnecting

​Additional Configuration

Overview

What You Can Do

Prerequisites

Connecting ECR

Alternative: Manual Role Creation

Required IAM Permissions

Security Model

After Connection

Image Scanning

Managing the Integration

Updating Configuration

Disconnecting

Additional Configuration