added policy to check image scan enable or not for ecr

avd_docs/aws/ecr/AVD-AWS-0191/docs.md

@@ -0,0 +1,13 @@
+
+Ensure ECR repository has image scans disabled.
+
+### Impact
+<!-- Add Impact here -->
+
+<!-- DO NOT CHANGE -->
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+
+

internal/rules/policies/cloud/policies/aws/ecr/enable_image_scans.rego

@@ -0,0 +1,25 @@
+# METADATA
+# title: "ECR Image Scans"
+# description: "Ensure ECR repository has image scans disabled."
+# scope: package
+# schemas:
+# - input: schema.input
+# related_resources:
+# - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
+# custom:
+#   avd_id: AVD-AWS-0191
+#   provider: aws
+#   service: ecr
+#   severity: HIGH
+#   short_code: enable-image-scans
+#   recommended_action: "Repository image scans should be enabled to ensure vulnerable software can be discovered and remediated as soon as possible."
+#   input:
+#     selector:
+#     - type: cloud
+package builtin.aws.ecr.aws0191
+
+deny[res] {
+	repo := input.aws.ecr.repositories[_]
+	not repo.imagescanning.scanonpush.value
+	res := result.new("Image scanning is not enabled.", repo.imagescanning.scanonpush)
+}

internal/rules/policies/cloud/policies/aws/ecr/enable_image_scans_test.rego

@@ -0,0 +1,11 @@
+package builtin.aws.ecr.aws0191
+
+test_detects_when_disabled {
+	r := deny with input as {"aws": {"ecr": {"repositories": [{"imagescanning": {"scanonpush": {"value": false}}}]}}}
+	count(r) == 1
+}
+
+test_when_enabled {
+	r := deny with input as {"aws": {"ecr": {"repositories": [{"imagescanning": {"scanonpush": {"value": true}}}]}}}
+	count(r) == 0
+}