How to fix AWS vulnerability alerts in Vanta for SOC 2 compliance?

Last updated: April 1, 2025

Context

When preparing for SOC 2 Type II auditing with Vanta, you may encounter security vulnerability alerts related to AWS containers managed by Qovery. These alerts typically highlight different levels of vulnerabilities (Critical, High, Medium, Low) in AWS Container packages.

Screenshot 2025-03-28 at 09.39.07.png

Answer

To resolve AWS container vulnerability alerts in Vanta:

  1. Check your AWS account for specific vulnerability details relating to your container packages

  2. Update your Dockerfile to include package updates:

    • Add commands to update all packages during the build process

    • Ensure your Dockerfile includes the latest security patches

  3. Force a rebuild of your container images

Note: After implementing these changes, it may take several hours for the vulnerability alerts to clear in Vanta's dashboard.