Docs

Code Pipeline

Build ECS images

ECS vulnerability scanning

The pipeline supports vulnerability scanning for specified ECS instances before image creation. This article describes how to configure the ECS vulnerability scanning built-in task.

Prerequisites

Cloud security center advanced edition or above is enabled. For instructions, refer to Purchase Cloud security center.

ECS instance created:

To create an ECS instance image using the custom method, you need to create an ECS instance first. For details, refer to Create ECS instance.

To create an ECS instance image using the upstream artifact in the pipeline, you need to configure the ECS instance creation built-in task first. For details, refer to ECS instance creation.

Add task

When creating or editing a pipeline, go to the Process Orchestration tab, click Add Job, and the Add Job drawer will pop up. Select Others > ECS vulnerability scanning as the task template.

Parameter description

Below are the parameters for this built-in task.

Job name

Customize the job name.

Upstream task

Show the name of the upstream sequential task for the current task. If there is no upstream task, - is shown.

Task configuration

Parameter	Description
Region	Select the region to which the ECS instance belongs.
ECS instance	Select the ECS instance for which the image will be created. Upstream artifact: Select the ECS instance created by the upstream built-in task ECS instance creation . Custom: Select the ECS instance you created yourself.
Scan type	The following vulnerability scan types are supported. Application vulnerabilities: Detect vulnerabilities in applications and their dependent packages running on hosts and containers. Linux software vulnerabilities: Detect vulnerabilities in officially maintained Linux operating system software, such as kernel, OpenSSL, Vim, glibc, and many others. Web-CMS vulnerabilities: Detect vulnerabilities in web content management systems (CMS), such as WordPress, Joomla, Drupal, and more. Windows system vulnerabilities: Detect vulnerabilities in the Windows operating system. Emergency vulnerabilities: Detect publicly disclosed system vulnerabilities that are high-risk and require urgent remediation.

Task output

Vulnerability report and the number of vulnerabilities. You can view and process specific vulnerabilities by clicking ECS vulnerability scanning > View on the pipeline details page, which redirects to Cloud security center. For methods to process vulnerabilities, refer to Process vulnerabilities.

Advanced settings

Webhook notification: Supports pushing task-level messages via Webhook and Larkbot, helping you stay informed about task updates in a timely manner.

Last updated: 2025.12.26 17:18:51