This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

ECS Inventory

Release Notes

1 - ECS Inventory Release Notes - Version 1.5.0

ECS Inventory v1.5.0

Requirements

  • When deploying ecs-inventory in your kubernetes cluster, helm chart v0.0.18 is available for your convenience.

New Features

Inventory Multiple AWS Accounts from a Single Agent

One agent can now inventory several AWS account-regions, each through its own IAM role, instead of needing a separate deployment per account. Add an assume-role list to the config file, giving each entry a role ARN, the region to inventory with those credentials, and an external ID where the target role’s trust policy requires one:

assume-role:
  - role-arn: arn:aws:iam::123456789012:role/anchore-ecs-inventory
    region: us-east-1
  - role-arn: arn:aws:iam::999999999999:role/anchore-ecs-inventory
    region: eu-west-1
    external-id: <external-id>

Each entry runs as an independent inventory pass, up to 20 entries. Assumed credentials refresh automatically as they expire, so a long-running agent keeps working without intervention.

An empty assume-role list is the default and preserves the existing behavior of inventorying the agent’s own account using the top-level region. Two things to know if you do configure roles:

  • The top-level region, --region, and ANCHORE_ECS_INVENTORY_REGION are ignored, and the agent warns if one is set. Every entry must name its own region.
  • The list can only be set in a config file. Setting ANCHORE_ECS_INVENTORY_ASSUME_ROLE is rejected at startup with an explicit error.

Every configured role is checked at startup and the agent exits if one cannot be assumed, so a misconfigured role surfaces immediately instead of as quietly missing inventory. Once the poll loop is running, a role that fails on one cycle is logged and retried on the next.

Rotating the static base credentials the agent uses to call STS still requires a restart. In the no-role case the agent rebuilds its AWS configuration each cycle, so rotated static credentials are picked up on the next poll.

Fixes

  • Fixes an issue where the agent inventoried only the first page of results returned by the AWS ECS APIs, capping each cluster at roughly 100 tasks and 10 services. Tasks, services, containers, and images beyond those limits were silently omitted, so they were never scanned for vulnerabilities or evaluated against policy, and repeated scans reported a slightly different subset each time. List calls are now paginated and describe calls batched. Every release before v1.5.0 is affected. After upgrading, expect inventory counts to rise in any region that was hitting the cap - those are objects that were always running, not new ones.
  • Various AWS SDK and dependency updates to improve security and performance.

Changelog

https://github.com/anchore/ecs-inventory/releases/tag/v1.5.0

2 - ECS Inventory Release Notes - Version 1.4.3

ECS Inventory v1.4.3

Requirements

  • Make sure to use ecs-inventory helm chart v0.0.17 when deploying.

Improvements

  • Documentation updates. No functional changes from v1.4.2.

Changelog

https://github.com/anchore/ecs-inventory/releases/tag/v1.4.3

3 - ECS Inventory Release Notes - Version 1.4.2

ECS Inventory v1.4.2

Improvements

  • Various package updates to improve security and performance.

Changelog

https://github.com/anchore/ecs-inventory/releases/tag/v1.4.2

4 - ECS Inventory Release Notes - Version 1.4.1

ECS Inventory v1.4.1

Requirements

  • Make sure to use ecs-inventory helm chart v0.0.16 when deploying.

Improvements

  • Various package updates to improve security and performance.

Changelog

https://github.com/anchore/ecs-inventory/releases/tag/v1.4.1

5 - ECS Inventory Release Notes - Version 1.4.0

ECS Inventory v1.4.0

Requirements

  • Make sure to use ecs-inventory helm chart v0.0.14 when deploying.

Improvements

  • Various package updates to improve security and performance.

Changelog

https://github.com/anchore/ecs-inventory/releases/tag/v1.4.0

6 - ECS Inventory Release Notes - Version 1.3.4

ECS Inventory v1.3.4

Requirements

  • Make sure to use ecs-inventory helm chart v0.0.10 when deploying.

Improvements

  • Various package updates to improve security and performance.

Changelog

https://github.com/anchore/ecs-inventory/releases/tag/v1.3.3

7 - ECS Inventory Release Notes - Version 1.3.3

ECS Inventory v1.3.3

Requirements

  • Make sure to use ecs-inventory helm chart v0.0.10 when deploying.

Fixes

  • Builds with the most recent version of go to reduced CVEs.

Changelog

https://github.com/anchore/ecs-inventory/releases/tag/v1.3.3