Skip to main content
Container scanning reads and scans the images in your cloud container registry, pulling image layers to check them for vulnerabilities and secrets.

​
Give CodeAnt access to your registry

​
AWS

Container scanning reads and scans your ECR images, which requires pulling image layers - the read-only CSPM policies can only list repositories, not download images. To enable it, attach the AWS managed policy AmazonEC2ContainerRegistryReadOnly to the CodeAnt IAM role you set up in AWS setup. It grants read-only access to your ECR registry (ecr:DescribeRepositories, ecr:DescribeImages, ecr:GetAuthorizationToken, ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and related read actions) so CodeAnt AI can pull and scan images for vulnerabilities and secrets.

​
GCP & Azure

Container scanning for GCP (Artifact Registry) and Azure (Container Registry) is not yet documented. Reach out to support if you need it.

​
Export an SBOM

Download the full package inventory of a scanned image as a software bill of materials (SBOM).
  1. Open the image’s results.
  2. Choose Export SBOM and pick CycloneDX 1.6 (JSON) or SPDX 2.3 (JSON).
Each package in the SBOM includes its name, version, type, the layer it came from and its license, where known. Export is available once the image’s scan has finished. If you see No package inventory for this image yet, rescan the image to generate an SBOM.