Skip to main content
Container scanning reads and scans the images in your cloud container registry, pulling image layers to check them for vulnerabilities and secrets.

​
AWS

Container scanning reads and scans your ECR images, which requires pulling image layers - the read-only CSPM policies can only list repositories, not download images. To enable it, attach the AWS managed policy AmazonEC2ContainerRegistryReadOnly to the CodeAnt IAM role you set up in AWS setup. It grants read-only access to your ECR registry (ecr:DescribeRepositories, ecr:DescribeImages, ecr:GetAuthorizationToken, ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and related read actions) so CodeAnt AI can pull and scan images for vulnerabilities and secrets.

​
GCP & Azure

Container scanning for GCP (Artifact Registry) and Azure (Container Registry) is not yet documented. Reach out to support if you need it.