Skip to main content
VM Scanning is agentless vulnerability, secret, and misconfiguration scanning of your cloud VMs’ disks — nothing is installed on the VM and the running instance is never touched. It reuses the same connection you set up for CSPM; follow the steps below to grant the few extra permissions each provider needs. How it works: Unlike CSPM (strictly read-only), VM Scanning takes a point-in-time snapshot of the VM’s disk, reads that copy, and deletes it when the scan finishes. Reading a snapshot instead of the live disk is what keeps the scan safe and consistent.

​
AWS

VM Scanning reuses the same IAM role you set up in AWS setup; follow the steps below to grant the few extra permissions it needs.
The role needs a few write actions (ec2:CreateSnapshot, ec2:CreateTags, ec2:DeleteSnapshot) beyond the read-only CSPM set. Every read action VM Scanning uses (ec2:Describe*, ebs:GetSnapshotBlock, ebs:ListSnapshotBlocks) is already covered by ReadOnlyAccess / ViewOnlyAccess.
1. Attach the VM Scanning policy to the CodeAnt IAM role. Open the CodeAnt IAM role in the AWS console, add a new inline policy, and paste the following:
If you already attached ReadOnlyAccess for CSPM, the only new permissions are the three in CodeAntVMScanSnapshot - the CodeAntVMScanRead block is included only so the policy is complete on its own.
2. (Optional) Restrict the write actions to CodeAnt’s snapshots. Every snapshot CodeAnt creates is tagged codeant-vm-scan=true. To scope the write actions to only those resources, replace the CodeAntVMScanSnapshot block above with this tag-conditioned statement:
3. (If applicable) Grant KMS access for encrypted volumes. If your EC2 volumes use KMS-encrypted EBS, also grant kms:Decrypt and kms:DescribeKey on the relevant keys so the snapshot blocks can be read. Skip this step if your volumes are unencrypted.

​
Azure

VM Scanning reuses the same service principal (app registration) you set up in Azure setup; follow the steps below to grant the one extra role it needs.
The service principal needs the Microsoft.Compute/snapshots/* actions, which Reader does not grant. Keep the existing Reader assignment in place — Disk Snapshot Contributor only covers snapshots, and Reader is still needed to read the source disk.
If you skip this role, the scan fails when it tries to create the snapshot, returning 403 Forbidden on a PUT .../providers/Microsoft.Compute/snapshots/... request.
Assign the Disk Snapshot Contributor role. Add the built-in Disk Snapshot Contributor role to the CSPM app (alongside Reader) using either the portal or the CLI:
  1. In the Azure Portal search bar, type Subscriptions and open the subscription you want to scan.
  2. In the left menu click Access control (IAM).
  3. Click + Add → Add role assignment.
  4. On the Role tab, search for Disk Snapshot Contributor, select it, and click Next.
  5. On the Members tab, click + Select members, search for your CSPM app (e.g. codeant-cspm), select it, and click Select.
  6. Click Review + assign to commit. Repeat for each subscription you want VM Scanning to cover.
Exact actions granted (all included in Disk Snapshot Contributor):

​
GCP

Agentless VM Scanning is not supported for GCP. It is currently available for AWS and Azure only.