> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Container Scanning

> Scan container registry images for vulnerabilities and secrets

Container scanning reads and scans the images in your cloud container registry, pulling image layers to check them for vulnerabilities and secrets.

### AWS

Container scanning reads and scans your ECR images, which requires pulling image layers - the read-only CSPM policies can only list repositories, not download images. To enable it, attach the AWS managed policy **`AmazonEC2ContainerRegistryReadOnly`** to the CodeAnt IAM role you set up in [AWS setup](/cloud_security/setup/aws). It grants read-only access to your ECR registry (`ecr:DescribeRepositories`, `ecr:DescribeImages`, `ecr:GetAuthorizationToken`, `ecr:GetDownloadUrlForLayer`, `ecr:BatchGetImage`, and related read actions) so CodeAnt AI can pull and scan images for vulnerabilities and secrets.

### GCP & Azure

<Note>
  Container scanning for GCP (Artifact Registry) and Azure (Container Registry) is not yet documented. Reach out to support if you need it.
</Note>