image-scanner-with-trivy 0.0.5

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,49 @@
+# image-scanner-with-trivy
+
+## What is
+
+This is an AWS CDK Construct that allows you to **scan a container image in CDK deployment layer with trivy**.
+
+If it detects vulnerabilities, it can **prevent the image from being pushed to the ECR for the application**.
+
+Since it takes an `imageUri` for ECR as an argument, it can also be used to **simply scan an existing image in the repository**.
+
+## Trivy
+
+[Trivy](https://github.com/aquasecurity/trivy) is a comprehensive and versatile security scanner.
+
+## Usage
+
+- Install
+
+```sh
+npm install image-scanner-with-trivy
+```
+
+- CDK Code
+
+```ts
+import { ImageScannerWithTrivy } from 'image-scanner-with-trivy';
+
+const repository = new Repository(this, 'ImageRepository', {
+  removalPolicy: RemovalPolicy.DESTROY,
+  autoDeleteImages: true,
+});
+
+const image = new DockerImageAsset(this, 'DockerImage', {
+  directory: resolve(__dirname, './'),
+});
+
+// Please grant the necessary options on a case-by-case basis.
+const imageScanner = new ImageScannerWithTrivy(this, 'ImageScannerWithTrivy', {
+  imageUri: image.imageUri,
+  repository: image.repository,
+});
+
+// By adding `addDependency`, if the vulnerabilities are detected by `ImageScannerWithTrivy`, the following `ECRDeployment` will not be executed, deployment will fail.
+const ecrDeployment = new ECRDeployment(this, 'DeployImage', {
+  src: new DockerImageName(image.imageUri),
+  dest: new DockerImageName(`${repository.repositoryUri}:latest`),
+});
+ecrDeployment.node.addDependency(imageScanner);
+```

package/assets/lambda/Dockerfile

@@ -0,0 +1,32 @@
+# ------------------------------------------------------------#
+# trivy Install Layer
+# ------------------------------------------------------------#
+FROM arm64v8/alpine:3.18 AS trivy
+
+WORKDIR /
+
+RUN mkdir -p /trivy
+
+RUN apk --update add --no-cache curl 
+
+RUN \
+    VERSION=$( \
+    curl --silent "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | \
+    grep '"tag_name":' | \
+    sed -E 's/.*"v([^"]+)".*/\1/' \
+    ) && curl -L -o trivy_${VERSION}_Linux-ARM64.tar.gz https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-ARM64.tar.gz \
+    && tar zxf trivy_${VERSION}_Linux-ARM64.tar.gz -C /trivy \
+    && rm trivy_${VERSION}_Linux-ARM64.tar.gz
+
+# ------------------------------------------------------------#
+# Run Layer
+# ------------------------------------------------------------#
+FROM public.ecr.aws/lambda/nodejs:18-arm64
+
+WORKDIR /
+
+COPY dist/index.js /var/task/index.js
+
+COPY --from=trivy /trivy/trivy /opt
+
+CMD ["index.handler"]

package/assets/lambda/dist/index.js

@@ -0,0 +1,7 @@
+"use strict";var S=Object.create;var c=Object.defineProperty;var $=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var I=Object.getPrototypeOf,U=Object.prototype.hasOwnProperty;var k=(r,e)=>{for(var s in e)c(r,s,{get:e[s],enumerable:!0})},h=(r,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let t of x(e))!U.call(r,t)&&t!==s&&c(r,t,{get:()=>e[t],enumerable:!(n=$(e,t))||n.enumerable});return r};var w=(r,e,s)=>(s=r!=null?S(I(r)):{},h(e||!r||!r.__esModule?c(s,"default",{value:r,enumerable:!0}):s,r)),E=r=>h(c({},"__esModule",{value:!0}),r);var b={};k(b,{handler:()=>j});module.exports=E(b);var y=require("child_process"),R=require("fs"),C=w(require("path"),1),j=async function(r){let e=r.RequestType,s=r.ResourceProperties.addr,n=r.ResourceProperties.imageUri,t=r.ResourceProperties.ignoreUnfixed,g=r.ResourceProperties.severity,u=r.ResourceProperties.scanners,p=r.ResourceProperties.imageConfigScanners,l=r.ResourceProperties.exitCode,m=r.ResourceProperties.exitOnEol,a=r.ResourceProperties.trivyIgnore,d=r.ResourceProperties.platform;if(!s||!n)throw new Error("addr and imageUri are required.");let P={PhysicalResourceId:s,Data:{}};if(e==="Create"||e==="Update"){let o=[];t==="true"&&o.push("--ignore-unfixed"),g.length&&o.push(`--severity ${g.join(",")}`),u.length&&o.push(`--scanners ${u.join(",")}`),p.length&&o.push(`--image-config-scanners ${p.join(",")}`),l&&o.push(`--exit-code ${l}`),m&&o.push(`--exit-on-eol ${m}`),a.length&&o.push("--ignorefile /tmp/.trivyignore"),d&&o.push(`--platform ${d}`),a.length&&(console.log("trivyignore: "+JSON.stringify(a)),v(a));let f=`/opt/trivy image --no-progress ${o.join(" ")} ${n}`;console.log("command: "+f),console.log("imageUri: "+n);let i=(0,y.spawnSync)(f,{shell:!0});if(console.log(`stderr:
+`+i.stderr?.toString()),console.log(`stdout:
+`+i.stdout?.toString()),i.status!==0)throw new Error(`Error: ${i.error}
+Signal: ${i.signal}
+Status: ${i.status}
+Image Scanner returned fatal errors. You may have vulnerabilities. See logs.`)}return P},v=r=>{let e=C.default.join("/tmp",".trivyignore"),s=(0,R.createWriteStream)(e);r.forEach(n=>{s.write(n+`
+`)}),s.end()};0&&(module.exports={handler});

package/assets/lambda/index.ts

@@ -0,0 +1,73 @@
+import { spawnSync } from 'child_process';
+import { createWriteStream } from 'fs';
+import path from 'path';
+import { CdkCustomResourceHandler, CdkCustomResourceResponse } from 'aws-lambda';
+
+export const handler: CdkCustomResourceHandler = async function (event) {
+  const requestType = event.RequestType;
+
+  const addr = event.ResourceProperties.addr as string;
+  const imageUri = event.ResourceProperties.imageUri as string;
+  const ignoreUnfixed = event.ResourceProperties.ignoreUnfixed as string;
+  const severity = event.ResourceProperties.severity as string[];
+  const scanners = event.ResourceProperties.scanners as string[];
+  const imageConfigScanners = event.ResourceProperties.imageConfigScanners as string[];
+  const exitCode = event.ResourceProperties.exitCode as number;
+  const exitOnEol = event.ResourceProperties.exitOnEol as number;
+  const trivyIgnore = event.ResourceProperties.trivyIgnore as string[];
+  const platform = event.ResourceProperties.platform as string;
+
+  if (!addr || !imageUri) throw new Error('addr and imageUri are required.');
+
+  const funcResponse: CdkCustomResourceResponse = {
+    PhysicalResourceId: addr,
+    Data: {} as { [key: string]: string },
+  };
+
+  if (requestType === 'Create' || requestType === 'Update') {
+    const options: string[] = [];
+    if (ignoreUnfixed === 'true') options.push('--ignore-unfixed');
+    if (severity.length) options.push(`--severity ${severity.join(',')}`);
+    if (scanners.length) options.push(`--scanners ${scanners.join(',')}`);
+    if (imageConfigScanners.length)
+      options.push(`--image-config-scanners ${imageConfigScanners.join(',')}`);
+    if (exitCode) options.push(`--exit-code ${exitCode}`);
+    if (exitOnEol) options.push(`--exit-on-eol ${exitOnEol}`);
+    if (trivyIgnore.length) options.push('--ignorefile /tmp/.trivyignore');
+    if (platform) options.push(`--platform ${platform}`);
+
+    if (trivyIgnore.length) {
+      console.log('trivyignore: ' + JSON.stringify(trivyIgnore));
+      makeTrivyIgnoreFile(trivyIgnore);
+    }
+
+    const cmd = `/opt/trivy image --no-progress ${options.join(' ')} ${imageUri}`;
+    console.log('command: ' + cmd);
+    console.log('imageUri: ' + imageUri);
+
+    const response = spawnSync(cmd, {
+      shell: true,
+    });
+
+    console.log('stderr:\n' + response.stderr?.toString());
+    console.log('stdout:\n' + response.stdout?.toString());
+
+    if (response.status !== 0)
+      throw new Error(
+        `Error: ${response.error}\nSignal: ${response.signal}\nStatus: ${response.status}\nImage Scanner returned fatal errors. You may have vulnerabilities. See logs.`,
+      );
+  }
+
+  return funcResponse;
+};
+
+const makeTrivyIgnoreFile = (trivyIgnore: string[]) => {
+  const trivyIgnoreFilePath = path.join('/tmp', '.trivyignore');
+  const trivyIgnoreFile = createWriteStream(trivyIgnoreFilePath);
+
+  trivyIgnore.forEach((line) => {
+    trivyIgnoreFile.write(line + '\n');
+  });
+
+  trivyIgnoreFile.end();
+};

package/lib/index.d.ts

@@ -0,0 +1,186 @@
+import { IRepository } from 'aws-cdk-lib/aws-ecr';
+import { Construct } from 'constructs';
+/**
+ * Enum for Severity Selection
+ *
+ * @see https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#severity-selection
+ */
+export declare enum Severity {
+    UNKNOWN = "UNKNOWN",
+    LOW = "LOW",
+    MEDIUM = "MEDIUM",
+    HIGH = "HIGH",
+    CRITICAL = "CRITICAL"
+}
+/**
+ * Enum for Scanners
+ *
+ * @see https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#enabledisable-scanners
+ */
+export declare enum Scanners {
+    VULN = "vuln",
+    CONFIG = "config",
+    SECRET = "secret",
+    LICENSE = "license"
+}
+/**
+ * Enum for ImageConfigScanners
+ *
+ * @see https://aquasecurity.github.io/trivy/latest/docs/target/container_image/#container-image-metadata
+ */
+export declare enum ImageConfigScanners {
+    CONFIG = "config",
+    SECRET = "secret"
+}
+export interface ImageScannerWithTrivyProps {
+    /**
+     * Image URI for scan target.
+     */
+    readonly imageUri: string;
+    /**
+     * Repository including the image URI for scan target.
+     *
+     * Because of grantPull to CustomResourceLambda.
+     */
+    readonly repository: IRepository;
+    /**
+     * The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution.
+     *
+     * To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag.
+     *
+     * @default false
+     *
+     * @see https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#unfixed-vulnerabilities
+     */
+    readonly ignoreUnfixed?: boolean;
+    /**
+     * Severity Selection
+     *
+     * The severity is taken from the selected data source since the severity from vendors is more accurate.
+     * Using CVE-2023-0464 as an example, while it is rated as "HIGH" in NVD, Red Hat has marked its 'Impact' as "Low". As a result, Trivy will display it as "Low".
+     *
+     * The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software.
+     * Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD.
+     *
+     * It defaults to `CRITICAL` IN THIS CONSTRUCT for safety in CI/CD, but the default configuration of Trivy is "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN".
+     *
+     * @default [Severity.CRITICAL]
+     *
+     * @see https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#severity-selection
+     */
+    readonly severity?: Severity[];
+    /**
+     * Enable/Disable Scanners
+     *
+     * You can enable/disable scanners with the `scanners`.
+     *
+     * For example, container image scanning enables vulnerability (VULN) and secret scanners (SECRET) by default.
+     * If you don't need secret scanning, it can be disabled by specifying Scanners.VULN only.
+     *
+     * @default [Security.VULN,Scanners.SECRET]
+     *
+     * @see https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#enabledisable-scanners
+     */
+    readonly scanners?: Scanners[];
+    /**
+     * Enum for ImageConfigScanners
+     *
+     * Container images have configuration. docker inspect and `docker history` show the information according to the configuration.
+     * Trivy scans the configuration of container images for
+     *
+     * - Misconfigurations
+     * - Secrets
+     *
+     * They are disabled by default. You can enable them with `imageConfigScanners`.
+     *
+     * @default []
+     *
+     * @see https://aquasecurity.github.io/trivy/latest/docs/target/container_image/#container-image-metadata
+     */
+    readonly imageConfigScanners?: ImageConfigScanners[];
+    /**
+     * Exit Code
+     *
+     * Use the `exitCode` option if you want to exit with a non-zero exit code.
+     *
+     * You can specify 0 if you do not want to exit even when vulnerabilities are detected.
+     *
+     * It defaults to 1 IN THIS CONSTRUCT for safety in CI/CD. In the original trivy, it is 0.
+     *
+     * @default 1
+     *
+     * @see https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#exit-code
+     */
+    readonly exitCode?: number;
+    /**
+     * Exit on EOL
+     *
+     * Sometimes you may surprisingly get 0 vulnerabilities in an old image:
+     *  - Enabling --ignore-unfixed option while all packages have no fixed versions.
+     *  - Scanning a rather outdated OS (e.g. Ubuntu 10.04).
+     *
+     * An OS at the end of service/life (EOL) usually gets into this situation, which is definitely full of vulnerabilities.
+     * `exitOnEol` can fail scanning on EOL OS with a non-zero code.
+     *
+     * It defaults to 1 IN THIS CONSTRUCT for safety in CI/CD. In the original trivy, it is 0.
+     *
+     * @default 1
+     *
+     * @see https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#exit-on-eol
+     */
+    readonly exitOnEol?: number;
+    /**
+     * By Finding IDs
+     *
+     * The ignore rules written to the .trivyignore in trivy.
+     * Put each line you write in the file into one element of the array.
+     *
+     * @example
+     *     $ cat .trivyignore
+     *     # Accept the risk
+     *     CVE-2018-14618
+     *
+     *     # Accept the risk until 2023-01-01
+     *     CVE-2019-14697 exp:2023-01-01
+     *
+     *     # No impact in our settings
+     *     CVE-2019-1543
+     *
+     *     # Ignore misconfigurations
+     *     AVD-DS-0002
+     *
+     *     # Ignore secrets
+     *     generic-unwanted-rule
+     *     aws-account-id
+     *
+     * @default []
+     *
+     * @see https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/#trivyignore
+     */
+    readonly trivyIgnore?: string[];
+    /**
+     * Custom Resource Memory Size (MB)
+     *
+     * You can specify between `3008` and `10240`.
+     *
+     * If this Construct execution terminates abnormally due to SIGKILL, try a larger size.
+     *
+     * Default value (`3008` MB) is Maximum memory size for default AWS account without quota limit increase.
+     *
+     * @default 3008
+     */
+    readonly memorySize?: number;
+    /**
+     * Scan Image on a specific Architecture and OS
+     *
+     * By default, Trivy loads an image on a `linux/amd64` machine.
+     *
+     * To customize this, pass a `platform` argument in the format OS/Architecture for the image, such as `linux/arm64`
+     *
+     * @default -
+     */
+    readonly platform?: string;
+}
+export declare class ImageScannerWithTrivy extends Construct {
+    constructor(scope: Construct, id: string, props: ImageScannerWithTrivyProps);
+}