ecrspectre

ecrspectre — Container registry waste auditor for ECR and Artifact Registry. Part of SpectreHub.

What it is

• Scans AWS ECR and GCP Artifact Registry for stale, untagged, and bloated images
• Checks pull timestamps, tag status, image size, and lifecycle policies
• Estimates monthly storage cost per finding
• Surfaces vulnerability scan data from ECR's built-in scanner
• Generates remediation plans: ECR lifecycle policies and dry-run delete scripts (read-only)
• Outputs text, JSON, SARIF, SpectreHub, policy, and delete-script formats

What it is NOT

• Not a real-time monitor — point-in-time scanner
• Not a remediation tool — reports only, never deletes images
• Not a security scanner — surfaces existing ECR scan data
• Not a CI image builder — audits what exists

Quick start

Homebrew

brew tap ppiankov/tap
brew install ecrspectre

Windows

Download the latest binary from Releases, or install with Go:

go install github.com/ppiankov/ecrspectre/cmd/ecrspectre@latest

From source

git clone https://github.com/ppiankov/ecrspectre.git
cd ecrspectre
make build

Usage

ecrspectre aws --region us-east-1 --format json
ecrspectre aws --all-regions --format delete-script

CLI commands

Command	Description
ecrspectre aws	Audit AWS ECR repositories for waste
ecrspectre gcp	Audit GCP Artifact Registry repositories for waste
ecrspectre init	Generate IAM policy and config file
ecrspectre version	Print version

SpectreHub integration

ecrspectre feeds container registry waste findings into SpectreHub for unified visibility across your infrastructure.

spectrehub collect --tool ecrspectre

Safety

ecrspectre operates in read-only mode. It inspects and reports — never modifies, deletes, or alters your images.

Documentation

Document	Contents
CLI Reference	Full command reference, flags, and configuration

License

MIT — see LICENSE.

---

Built by Obsta Labs