> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# VM Scanning

> Agentless VM disk scanning for AWS and Azure

VM Scanning is **agentless** vulnerability, secret, and misconfiguration scanning of your cloud VMs' disks — nothing is installed on the VM and the running instance is never touched. It reuses the same connection you set up for CSPM; follow the steps below to grant the few extra permissions each provider needs.

**How it works:** Unlike CSPM (strictly read-only), VM Scanning takes a **point-in-time snapshot** of the VM's disk, reads that copy, and **deletes it** when the scan finishes. Reading a snapshot instead of the live disk is what keeps the scan safe and consistent.

### AWS

VM Scanning reuses the same IAM role you set up in [AWS setup](/cloud_security/setup/aws); follow the steps below to grant the few extra permissions it needs.

<Note>
  The role needs a few **write** actions (`ec2:CreateSnapshot`, `ec2:CreateTags`, `ec2:DeleteSnapshot`) beyond the read-only CSPM set. Every read action VM Scanning uses (`ec2:Describe*`, `ebs:GetSnapshotBlock`, `ebs:ListSnapshotBlocks`) is already covered by `ReadOnlyAccess` / `ViewOnlyAccess`.
</Note>

**1. Attach the VM Scanning policy to the CodeAnt IAM role.**
Open the CodeAnt IAM role in the AWS console, add a new inline policy, and paste the following:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CodeAntVMScanRead",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeVolumes",
        "ec2:DescribeImages",
        "ec2:DescribeSnapshots",
        "ebs:ListSnapshotBlocks",
        "ebs:GetSnapshotBlock"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CodeAntVMScanSnapshot",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSnapshot",
        "ec2:CreateTags",
        "ec2:DeleteSnapshot"
      ],
      "Resource": "*"
    }
  ]
}
```

<Note>
  If you already attached `ReadOnlyAccess` for CSPM, the **only new permissions** are the three in `CodeAntVMScanSnapshot` - the `CodeAntVMScanRead` block is included only so the policy is complete on its own.
</Note>

**2. (Optional) Restrict the write actions to CodeAnt's snapshots.**
Every snapshot CodeAnt creates is tagged `codeant-vm-scan=true`. To scope the write actions to only those resources, replace the `CodeAntVMScanSnapshot` block above with this tag-conditioned statement:

```json theme={null}
{
  "Sid": "CodeAntVMScanSnapshotScoped",
  "Effect": "Allow",
  "Action": ["ec2:DeleteSnapshot", "ec2:CreateTags"],
  "Resource": "arn:aws:ec2:*:*:snapshot/*",
  "Condition": {
    "StringEquals": { "aws:ResourceTag/codeant-vm-scan": "true" }
  }
}
```

**3. (If applicable) Grant KMS access for encrypted volumes.**
If your EC2 volumes use KMS-encrypted EBS, also grant `kms:Decrypt` and `kms:DescribeKey` on the relevant keys so the snapshot blocks can be read. Skip this step if your volumes are unencrypted.

### Azure

VM Scanning reuses the same service principal (app registration) you set up in [Azure setup](/cloud_security/setup/azure); follow the steps below to grant the one extra role it needs.

<Note>
  The service principal needs the `Microsoft.Compute/snapshots/*` actions, which **Reader does not grant**. Keep the existing **Reader** assignment in place — Disk Snapshot Contributor only covers snapshots, and Reader is still needed to read the source disk.
</Note>

<Warning>
  If you skip this role, the scan fails when it tries to create the snapshot, returning `403 Forbidden` on a `PUT .../providers/Microsoft.Compute/snapshots/...` request.
</Warning>

**Assign the Disk Snapshot Contributor role.**
Add the built-in **Disk Snapshot Contributor** role to the CSPM app (alongside Reader) using either the portal or the CLI:

<Tabs>
  <Tab title="Azure Portal">
    1. In the Azure Portal search bar, type **Subscriptions** and open the subscription you want to scan.
    2. In the left menu click **Access control (IAM)**.
    3. Click **+ Add → Add role assignment**.
    4. On the **Role** tab, search for `Disk Snapshot Contributor`, select it, and click **Next**.
    5. On the **Members** tab, click **+ Select members**, search for your CSPM app (e.g. `codeant-cspm`), select it, and click **Select**.
    6. Click **Review + assign** to commit. Repeat for each subscription you want VM Scanning to cover.
  </Tab>

  <Tab title="Azure CLI">
    ```bash theme={null}
    az role assignment create \
      --assignee YOUR_APP_ID \
      --role "Disk Snapshot Contributor" \
      --scope "/subscriptions/YOUR_SUBSCRIPTION_ID"
    ```

    Run this for each subscription. `YOUR_APP_ID` is the **Application (client) ID** of the app registration used for CSPM.
  </Tab>
</Tabs>

**Exact actions granted** (all included in Disk Snapshot Contributor):

| Action                                              | Used for                             |
| --------------------------------------------------- | ------------------------------------ |
| `Microsoft.Compute/snapshots/write`                 | Create the snapshot                  |
| `Microsoft.Compute/snapshots/read`                  | Poll provisioning state              |
| `Microsoft.Compute/snapshots/beginGetAccess/action` | Generate a read SAS for the snapshot |
| `Microsoft.Compute/snapshots/endGetAccess/action`   | Revoke the SAS                       |
| `Microsoft.Compute/snapshots/delete`                | Delete the snapshot after the scan   |

### GCP

<Note>
  Agentless VM Scanning is **not supported for GCP**. It is currently available for AWS and Azure only.
</Note>