Describe the bug

Hi CDK team,

A recent change to Repository started automatically adding ImageScanningConfiguration to the generated CloudFormation for AWS::ECR::Repository even when scanOnPush is undefined. This property is not supported in all regions (e.g. us-iso-east-1) and causes CloudFormation deployments to fail on the unrecognized property.

Line in question:

Suggested logic:

imageScanningConfiguration: props.imageScanOnPush === undefined ? undefined : { scanOnPush: props.imageScanOnPush },

The current workaround is to remove that property via escape hatch, however customers only know to do this after the deployment has already failed which is far from ideal.

const cfnRepo = somRepository.node.defaultChild as CfnRepository;
cfnRepo.addPropertyDeletionOverride('ImageScanningConfiguration');

Expected Behavior

ImageScanningConfiguration property is only added to AWS::ECR::Repository when scanOnPush is explicitly defined.

Current Behavior

ImageScanningConfiguration is always added even for unsupported regions.

Reproduction Steps

// Note: imageScanOnPush is not being set
const repo = new Repository(this, 'SomeRepo', {});

Possible Solution

(untested) Change the line to:

imageScanningConfiguration: props.imageScanOnPush === undefined ? undefined : { scanOnPush: props.imageScanOnPush },

Additional Information/Context

No response

CDK CLI Version

2.18.0 (build 75c90fa)

Framework Version

No response

Node.js Version

node-v14.19.1

OS

MacOS

Language

Typescript

Language Version

No response

Other information

No response