Streamlining container security: Red Hat Hardened Images now supported in AWS InspectorScan API and ECR Basic scanning

Software security teams can face an overwhelming influx of vulnerability alerts, often stemming from non-essential packages bundled inside traditional container base images. When developers inherit base images packed with unneeded tools, shells, and package managers, security teams end up triaging noise, and developers end up burdened with Common Vulnerabilities and Exposures (CVE) remediations. To ease this friction and help organizations move toward a zero-CVE strategy, container infrastructure requires a purpose-built starting point that cuts away unnecessary attack surface from day one.

To address this challenge and strengthen defense-in-depth across the hybrid cloud, support for Red Hat Hardened Images is live in the AWS InspectorScan API and ECR Basic scanning. By further expanding Red Hat’s collaboration with AWS, we’re delivering a smoother way to verify software supply chain integrity and maintain cleaner security profiles directly within native AWS workflows. Red Hat Hardened Images and AWS scanning gives security and developer teams the flexibility to choose the technology that best fits their project's needs, while strengthening security standards.

Easing workflows for developers and security engineers

Red Hat Hardened Images is a catalog of essential container images built for deployment across vendor-agnostic infrastructure, containing only the specific files required for an application to run. Built using Red Hat’s trusted software pipeline, these pre-hardened images are rigorously tested for operational functionality and optimized to mitigate as many known security vulnerabilities as possible at release. By removing unnecessary software that increases attack surface and security noise, this minimalist approach provides a purpose-built path toward a zero-CVE environment.

Red Hat’s collaboration with AWS addresses the unique needs of both security engineers and developers. Security engineers benefit from a secure-by-default posture, cleaner security scans, faster CVE remediations, and standardized security profiles that support compliance certifications like CIS, STIG, and OpenSCAP. Developers gain freedom of choice across components and versions, easier adoption through drop-in compatibility, and comprehensive documentation. 

From build to registry: Layering container security

Amazon ECR Basic scanning is built-in vulnerability detection for container images stored in Amazon Elastic Container Registry (ECR). It uses AWS-native technology sourcing more than 50 data feeds, including vendor security advisories, threat intelligence feeds, and the National Vulnerability Database (NVD), to identify known CVEs in operating system packages. Teams can configure scanning to run automatically on image push or trigger it manually, receiving findings directly within their ECR console and through Amazon EventBridge for downstream alerting and automation.

The AWS InspectorScan API extends vulnerability analysis into CI/CD pipelines and automated build workflows. It accepts a Software Bill of Materials (SBOM)–generated by the Amazon Inspector SBOM Generator from container images, archives, or compiled binaries–and returns a detailed vulnerability report scored with NVD and CVSS ratings. This lets development teams shift security left by scanning images for vulnerabilities during the build process, before they ever reach a registry, enabling gate checks that block insecure images from progressing to production.

Together, these services provide layered coverage. The InspectorScan API catches vulnerabilities early in the pipeline, while ECR Basic scanning provides ongoing detection for images already stored in your registry.

Purpose-built variants for multi-stage builds

Red Hat Hardened Images offers security engineers a minimal attack surface while also giving developers the tooling needed for innovation. By offering distinct image variants, teams can implement multi-stage builds without compromising on compliance or usability.

• Default: The lean, distroless runtime image built for production deployments. It includes no shell or package manager by default, minimizing attack surface while keeping container sizes small.
• Builder: Designed for development and multi-stage build pipelines. It contains package managers and shells to compile code and install build-time dependencies before passing only the final binary into a clean default runtime image.
• FIPS: Designed for regulated environments, enforcing Federal Information Processing Standards (FIPS) 140-2/3 validated cryptography modules when running on FIPS-enabled host clusters.

The Red Hat Hardened Images catalog offers nearly 60 core images and over 150 variants designed to provide a resilient foundation for organizations pursuing zero-CVE strategies. To explore, visit images.redhat.com or the Amazon ECR User Guide.