---
title: >-
  Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third
  party provider
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Ensure Image Vulnerability Scanning
  using Amazon ECR image scanning or a third party provider
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third party provider
 
## Description{% #description %}

Amazon ECR registry-level scanning controls how container images are scanned for vulnerabilities. For registries with valid image-to-registry relationship data, this rule verifies that the registry has at least one native ECR scanning rule with a valid frequency (`SCAN_ON_PUSH` or `CONTINUOUS_SCAN`); registries without associated images are skipped, while registries with missing or empty relationship keys fail conservatively. Related images with unusable relationship keys cannot be associated with a registry and are ignored. The evaluator cannot determine whether every repository is covered by the configured filters, whether an image is used by EKS, or whether a third-party scanner provides equivalent coverage, so findings for those configurations may require muting.

## Remediation{% #remediation %}

Enable enhanced or basic scanning on the ECR registry with an appropriate scan frequency so that all repositories are continuously assessed for vulnerabilities. See the [Amazon ECR image scanning documentation](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) for configuration steps.

## References{% #references %}

- [Amazon EKS security best practices](https://docs.aws.amazon.com/eks/latest/best-practices/security.html)