Regarding docker images, I use the image scanning feature of ECR: https://aws.amazon.com/blogs/containers/amazon-ecr-native-co...

The docs make it look really complicated, but it comes down to enabling the service on the Terraform config.

Also for app dependencies, I use bots to open PRs on my repo whenever an important security fix is published for one of my dependencies.