Docs: Security Hub ECR images in use only

[svader0]

Description

Documents the new ECR Images in Use Only toggle of the AWS Security Hub connector (DefectDojo Pro). If the toggle is on, the connector imports findings on an ECR image only if Amazon Inspector reports the image running. The section covers what the toggle keeps and closes, which runtimes count (ECS and EKS, also on Fargate), how fresh the Inspector data is, and the continuous-scanning need. It also covers the inspector2:ListCoverage permission and its check at save. Last, it says which Records skip under each grouping when Inspector cannot answer. It also fixes one stale form section name on the page ("Import Configuration").

Merge this together with the matching DefectDojo Pro change, so the page does not publish before the toggle ships.

Test results

Docs only. Page changed: docs/content/connectors/toolreference/security_hub.md.

Documentation

This PR is the documentation.

[dryrunsecurity]

This pull request modifies sensitive codepaths in dojo/db_migrations and dojo/finding by an author not on the allowed list. These changes are flagged as low severity and are not blocking.

Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/db_migrations/0299_finding_test_numsev_index.py (drs_bfc926a5)

Vulnerability	Configured Sensitive Codepath Modified by Non-Allowed Author
Description	File 'dojo/db_migrations/0299_finding_test_numsev_index.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by 'svader0' (commit 88a12f7) who is not in the allowed authors list.

Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/models.py (drs_8535b7d8)

Vulnerability	Configured Sensitive Codepath Modified by Non-Allowed Author
Description	File 'dojo/finding/models.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'svader0' (commit 88a12f7) who is not in the allowed authors list.

---

Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.

[Maffooch]

Holding this with the connector and Pro changes, which have open items. The page matches the code on the label, default off, scope (ECR container image findings only), the in-use rule, inspector2:ListCoverage, and the denied and skip behaviors. AWS's Inspector docs confirm the 36-hour, once-a-day and continuous-scanning statements.

Suggested changes to security_hub.md:

• After the 36-hour bullet, cite the source: "See Mapping container images to running containers in the Amazon Inspector documentation."
• Start the continuous-scanning bullet with: "Amazon Inspector ECR scanning must be on in every region you sync." The skip warning names this cause, and the page currently explains only the delegated-administrator one.
• Add: "Amazon Inspector does not support last-in-use tracking for multi-architecture images. Check that such an image shows as in use in Amazon Inspector before you rely on the toggle for it."
• Tighten the skip bullet to match the code (it skips only when Inspector covers no images at all, not when none is running): "If Inspector covers no images at all for an account and region with image findings, the connector skips that Record. This happens when ECR scanning is off in that region, or when the access key is not the delegated administrator for a member account."
• Depending on how the connector review lands: say that a skipped Record also stops syncing its non-image findings, and that "in use" counts only ECS tasks and EKS pods.