CKV_AWS_107: aws_iam_policy for action ecr:GetAuthorizationToken with resource "*"

Is your feature request related to a problem? Please describe. We have an aws iam policy with the following statement: statement { actions = [ "ecr:GetAuthorizationToken" ] resources = [ "*" ] }

checkov fails here with the message CKV_AWS_107: “Ensure IAM policies does not allow credentials exposure” but according to the aws documentation we found (https://docs.aws.amazon.com/AmazonECR/latest/public/security_iam_id-based-policy-examples.html) we need to set resources = “*”.

Describe the solution you’d like Is it possible to change the check CKV_AWS_107 to allow the above action with resources = “*”?

[schosterbarak]

@kmcquade so we would probably want to exclude that if the resource is attached to ECR but to alarm for the rest. We don’t have that capability yet, but should be available from soon where we will enable resource graph queries in checkov. I’ll keep this ticket open for now and will update once the implementation is done

[schosterbarak]

Thanks @kmcquade !