---
title: >-
  Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third
  party provider
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Ensure Image Vulnerability Scanning
  using Amazon ECR image scanning or a third party provider
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third party provider
 
## Description{% #description %}

Amazon ECR registry-level scanning controls how container images are scanned for vulnerabilities. This rule verifies that the ECR registry has at least one scanning rule with a valid scan frequency (`SCAN_ON_PUSH` or `CONTINUOUS_SCAN`) so images are continuously assessed for known vulnerabilities before they are pulled into EKS workloads. Leaving image scanning disabled allows vulnerable images to be deployed, increasing the attack surface of the environment.

## Remediation{% #remediation %}

Enable enhanced or basic scanning on the ECR registry with an appropriate scan frequency so that all repositories are continuously assessed for vulnerabilities. See the [Amazon ECR image scanning documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) for configuration steps.

## References{% #references %}

- [Amazon EKS security best practices](https://docs.aws.amazon.com/eks/latest/best-practices/security.html)
- [CIS Amazon EKS Benchmark](https://www.cisecurity.org/benchmark/kubernetes)