Can it fail a build when it finds vulnerabilities?

Yes. Set --exit-code to a non-zero value together with --severity, and the scan returns that code when a vulnerability at or above your threshold is found. Wire the node into a release gate so the pipeline stops on a HIGH or CRITICAL CVE.

How do I see only vulnerabilities that have a fix?

Turn on --ignore-unfixed. The report then drops CVEs with no upstream patch and lists only issues you can remediate by bumping a package or rebuilding the image, which keeps the triage queue actionable.

Can it detect Log4Shell (CVE-2021-44228) in my images?

Yes. Trivy inspects application libraries inside the image, including Java jar files, so a vulnerable log4j-core version shows up as a library finding. Keep --vuln-type set to include library (the default is os,library) so those dependencies are reported.

Can it scan images that are not in ECR?

No. This node is built for ECR and handles the AWS login for you. For images in Docker Hub, GHCR, another registry, or a local tarball, use trivy-image-scan instead.

Does it check for misconfigurations or secrets too?

Set --security-checks to vuln,config to add configuration checks alongside CVE detection. Trivy's secret and SBOM scanning are upstream features of the CLI that this node does not expose, so use them through the standalone tool if you need them.

Updated Jul 14, 2026

Containers

Scan Amazon ECR container images for CVEs with Trivy

Trivy vulnerability scanning for container images stored in Amazon ECR.

Scan images stored in ECR Gate a release on severity Focus on actionable findings

overview

What trivy-ecr-scan does

trivy-ecr-scan runs Aqua Security's Trivy against container images pulled from Amazon Elastic Container Registry. It logs into ECR with the AWS credentials you supply, reads a list of images, and scans each one for known vulnerabilities in both the OS packages and the application libraries baked into the layers. The result is a per-image inventory of CVEs you can gate a pipeline on.

It is tuned for registry workflows. You feed it a file of image references and a colon-separated AWS credential string, then shape the scan with the usual Trivy knobs: filter by severity, restrict to OS or library vulnerability types, ignore unfixed issues, and set an exit code so a build fails when something serious turns up. Output formats include table, JSON, and SARIF so findings flow into dashboards and code-scanning tools.

On Trickest, trivy-ecr-scan is a Containers-category node that takes an image list and ECR credentials and writes a folder of results. Reach for it to scan the images your build pushes to ECR, on a schedule or as a release gate, and route the findings into reporting downstream.

source github.com/aquasecurity/trivy

use cases

Where trivy-ecr-scan fits

Scan images stored in ECR

Log into ECR with AWS credentials and scan a list of registry images for OS and library CVEs, so the artifacts you ship get checked where they live.

Gate a release on severity

Filter to HIGH and CRITICAL with --severity and set --exit-code so a build fails when a serious vulnerability appears, stopping a risky image before it deploys.

Focus on actionable findings

Turn on --ignore-unfixed so the report lists only vulnerabilities with an available patch, keeping the triage queue to issues you can remediate now.

Feed findings into dashboards

Emit JSON or SARIF with --format so the scan results flow into code-scanning tools and reporting instead of staying as console output.

Automate CVE scanning on a schedule

Wire the node into a scheduled workflow so every image in ECR gets re-scanned against a fresh vulnerability database as new CVEs are published.

reference

trivy-ecr-scan inputs and flags

18 inputs

Name	Type	Flag	Description
image-list	FILE	·	List of images, one per line, to scan.
aws-credentials	FILE	·	ECR login as AWS_ACCESS_KEY_ID:AWS_SECRET_ACCESS_KEY:AWS_DEFAULT_REGION.
severity	STRING	--severity	Severities to display (default UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL).
format	STRING	--format	Output format: table, json, sarif, or template (default table).
vuln-type	STRING	--vuln-type	Vulnerability types to scan: os, library (default os,library).
exit-code	STRING	--exit-code	Exit code to return when vulnerabilities are found (default 0).
ignore-unfixed	BOOLEAN	--ignore-unfixed	Display only vulnerabilities that have a fix available.
security-checks	STRING	--security-checks	Security issues to detect: vuln, config (default vuln).

Showing key inputs. trivy-ecr-scan exposes 18 inputs in total.

Full flag reference (18 inputs)

Name	Type	Flag	Description
light	BOOLEAN	--light	deprecated (default false)
format	STRING	--format	output format: table, json, sarif, template (default table)
timeout	STRING	--timeout	scan timeout (default 5m0s)
insecure	BOOLEAN	--insecure	allow insecure server connections over SSL (default false)
severity	STRING	--severity	severities to display, comma separated (default UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL)
exit-code	STRING	--exit-code	exit code returned when vulnerabilities are found (default 0)
skip-dirs	STRING	--skip-dirs	directories where traversal is skipped
vuln-type	STRING	--vuln-type	comma-separated vulnerability types: os, library (default os,library)
image-list	FILE	·	list of images, one per line, to be scanned
skip-files	STRING	--skip-files	file paths to skip during traversal
no-progress	BOOLEAN	--no-progress	suppress the progress bar (default false)
removed-pkgs	BOOLEAN	--removed-pkgs	detect vulnerabilities in removed packages, Alpine only (default false)
ignore-policy	FILE	--ignore-policy	Rego file used to evaluate each vulnerability
list-all-pkgs	BOOLEAN	--list-all-pkgs	output all packages regardless of vulnerability (default false)
ignore-unfixed	BOOLEAN	--ignore-unfixed	display only vulnerabilities that have a fix (default false)
skip-db-update	BOOLEAN	--skip-db-update	skip updating the vulnerability database (default false)
aws-credentials	FILE	·	ECR login as AWS_ACCESS_KEY_ID:AWS_SECRET_ACCESS_KEY:AWS_DEFAULT_REGION (colon-separated)
security-checks	STRING	--security-checks	comma-separated security issues to detect: vuln, config (default vuln)

example

Run trivy-ecr-scan

trivy-ecr-scan · command

# fail the build on fixable HIGH/CRITICAL CVEs in an ECR imagetrivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 \  111122223333.dkr.ecr.us-east-1.amazonaws.com/example/api:latest

sample output

example/api:latest (debian 12.4)Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 4, CRITICAL: 1) ┌──────────┬────────────────┬──────────┬──────────┬───────────────┬──────────────────────────────┐│ Library  │ Vulnerability  │ Severity │  Status  │ Installed Ver │            Title             │├──────────┼────────────────┼──────────┼──────────┼───────────────┼──────────────────────────────┤│ libssl3  │ CVE-2024-6119  │ HIGH     │ fixed    │ 3.0.11-1      │ openssl: denial of service   ││ libc6    │ CVE-2023-4911  │ CRITICAL │ fixed    │ 2.36-9        │ glibc: buffer overflow ld.so ││ zlib1g   │ CVE-2023-45853 │ HIGH     │ affected │ 1.2.13.dfsg-1 │ zlib: integer overflow       │└──────────┴────────────────┴──────────┴──────────┴───────────────┴──────────────────────────────┘

guidance

Choosing trivy-ecr-scan

Use trivy-ecr-scan when your images live in Amazon ECR and you want them scanned where they are stored, with AWS login handled for you. For images in Docker Hub or another registry, or for local images, use trivy-image-scan instead.

trivy-image-scan

Scans images from any registry or locally. Use it when the images are not in ECR.

trufflehog

Hunts secrets in code and artifacts. Pair it with Trivy to cover leaked credentials alongside CVEs.

nuclei

Tests running services for issues. Trivy inspects the image contents; the two cover different layers.

faq

trivy-ecr-scan questions

Pass AWS credentials as a colon-separated AWS_ACCESS_KEY_ID:AWS_SECRET_ACCESS_KEY:AWS_DEFAULT_REGION string in the aws-credentials input. The node uses it to log into the registry and pull each image in your list before scanning.

trivy-image-scan
Trivy scanning for container images: vulnerabilities, secrets, misconfigurations, and licenses.

Run trivy-ecr-scan yourself

An image list and ECR credentials feed trivy-ecr-scan, which pulls each image, scans it for CVEs, and writes the vulnerabilities as an output.

Run trivy-ecr-scan in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

image-list

FILE

List of images, one per line, to scan.

aws-credentials

FILE

ECR login as AWS_ACCESS_KEY_ID:AWS_SECRET_ACCESS_KEY:AWS_DEFAULT_REGION.

severity

STRING

--severity

Severities to display (default UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL).

format

STRING

--format

Output format: table, json, sarif, or template (default table).

vuln-type

STRING

--vuln-type

Vulnerability types to scan: os, library (default os,library).

exit-code

STRING

--exit-code

Exit code to return when vulnerabilities are found (default 0).

ignore-unfixed

BOOLEAN

--ignore-unfixed

Display only vulnerabilities that have a fix available.

security-checks

STRING

--security-checks

Security issues to detect: vuln, config (default vuln).

Name

Type

Flag

Description

light

BOOLEAN

--light

deprecated (default false)

format

STRING

--format

output format: table, json, sarif, template (default table)

timeout

STRING

--timeout

scan timeout (default 5m0s)

insecure

BOOLEAN

--insecure

allow insecure server connections over SSL (default false)

severity

STRING

--severity

severities to display, comma separated (default UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL)

exit-code

STRING

--exit-code

exit code returned when vulnerabilities are found (default 0)

skip-dirs

STRING

--skip-dirs

directories where traversal is skipped

vuln-type

STRING

--vuln-type

comma-separated vulnerability types: os, library (default os,library)

image-list

FILE

list of images, one per line, to be scanned

skip-files

STRING

--skip-files

file paths to skip during traversal

no-progress

BOOLEAN

--no-progress

suppress the progress bar (default false)

removed-pkgs

BOOLEAN

--removed-pkgs

detect vulnerabilities in removed packages, Alpine only (default false)

ignore-policy

FILE

--ignore-policy

Rego file used to evaluate each vulnerability

list-all-pkgs

BOOLEAN

--list-all-pkgs

output all packages regardless of vulnerability (default false)

ignore-unfixed

BOOLEAN

--ignore-unfixed

display only vulnerabilities that have a fix (default false)

skip-db-update

BOOLEAN

--skip-db-update

skip updating the vulnerability database (default false)

aws-credentials

FILE

ECR login as AWS_ACCESS_KEY_ID:AWS_SECRET_ACCESS_KEY:AWS_DEFAULT_REGION (colon-separated)

security-checks

STRING

--security-checks

comma-separated security issues to detect: vuln, config (default vuln)

example/api:latest (debian 12.4)Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 4, CRITICAL: 1) ┌──────────┬────────────────┬──────────┬──────────┬───────────────┬──────────────────────────────┐│ Library │ Vulnerability │ Severity │ Status │ Installed Ver │ Title │├──────────┼────────────────┼──────────┼──────────┼───────────────┼──────────────────────────────┤│ libssl3 │ CVE-2024-6119 │ HIGH │ fixed │ 3.0.11-1 │ openssl: denial of service ││ libc6 │ CVE-2023-4911 │ CRITICAL │ fixed │ 2.36-9 │ glibc: buffer overflow ld.so ││ zlib1g │ CVE-2023-45853 │ HIGH │ affected │ 1.2.13.dfsg-1 │ zlib: integer overflow │└──────────┴────────────────┴──────────┴──────────┴───────────────┴──────────────────────────────┘

Scan Amazon ECR container images for CVEs with Trivy

What trivy-ecr-scan does

Where trivy-ecr-scan fits

Scan images stored in ECR

Gate a release on severity

Focus on actionable findings

Feed findings into dashboards

Automate CVE scanning on a schedule

trivy-ecr-scan inputs and flags

Run trivy-ecr-scan

Choosing trivy-ecr-scan

trivy-image-scan

trufflehog

nuclei

trivy-ecr-scan questions

More Containers tools

trivy-image-scan

Run trivy-ecr-scan yourself

Scan Amazon ECR container images for CVEs with Trivy

What trivy-ecr-scan does

Where trivy-ecr-scan fits

Scan images stored in ECR

Gate a release on severity

Focus on actionable findings

Feed findings into dashboards

Automate CVE scanning on a schedule

trivy-ecr-scan inputs and flags

Run trivy-ecr-scan

Choosing trivy-ecr-scan

trivy-image-scan

trufflehog

nuclei

trivy-ecr-scan questions

More Containers tools

trivy-image-scan

Run trivy-ecr-scan yourself