Containers
Find OS and library CVEs in Amazon ECR images
Trivy CVE scanning for container images stored in Amazon ECR.
overview
What trivy-ecr-scan does
trivy-ecr-scan runs Aqua Trivy against container images in Amazon ECR. It logs in with aws-credentials, reads image-list, and reports OS and library CVEs per image.
Shape the scan with --severity, --vuln-type, --ignore-unfixed, and --exit-code so a pipeline can fail on HIGH or CRITICAL findings. Emit table, json, or sarif with --format.
Use when images live in ECR and AWS login should stay in the node. For Docker Hub, GHCR, or local images, use trivy-image-scan instead.
use cases
Where trivy-ecr-scan fits
Scan images stored in ECR
Log into ECR with AWS credentials and scan a list of registry images for OS and library CVEs, so the artifacts you ship get checked where they live.
Gate a release on severity
Filter to HIGH and CRITICAL with --severity and set --exit-code so a build fails when a serious vulnerability appears, stopping a risky image before it deploys.
Focus on actionable findings
Turn on --ignore-unfixed so the report lists only vulnerabilities with an available patch, keeping the triage queue to issues you can remediate now.
Feed findings into dashboards
Emit JSON or SARIF with --format so the scan results flow into code-scanning tools and reporting instead of staying as console output.
Automate CVE scanning on a schedule
Wire the node into a scheduled workflow so every image in ECR gets re-scanned against a fresh vulnerability database as new CVEs are published.
reference
trivy-ecr-scan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| image-list | FILE | · | List of images, one per line, to scan. |
| aws-credentials | FILE | · | ECR login as AWS_ACCESS_KEY_ID:AWS_SECRET_ACCESS_KEY:AWS_DEFAULT_REGION. |
| severity | STRING | --severity | Severities to display (default UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL). |
| format | STRING | --format | Output format: table, json, sarif, or template (default table). |
| vuln-type | STRING | --vuln-type | Vulnerability types to scan: os, library (default os,library). |
| exit-code | STRING | --exit-code | Exit code to return when vulnerabilities are found (default 0). |
| ignore-unfixed | BOOLEAN | --ignore-unfixed | Display only vulnerabilities that have a fix available. |
| security-checks | STRING | --security-checks | Security issues to detect: vuln, config (default vuln). |
Showing key inputs. trivy-ecr-scan exposes 18 inputs in total.
Full flag reference (18 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| light | BOOLEAN | --light | deprecated (default false) |
| format | STRING | --format | output format: table, json, sarif, template (default table) |
| timeout | STRING | --timeout | scan timeout (default 5m0s) |
| insecure | BOOLEAN | --insecure | allow insecure server connections over SSL (default false) |
| severity | STRING | --severity | severities to display, comma separated (default UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) |
| exit-code | STRING | --exit-code | exit code returned when vulnerabilities are found (default 0) |
| skip-dirs | STRING | --skip-dirs | directories where traversal is skipped |
| vuln-type | STRING | --vuln-type | comma-separated vulnerability types: os, library (default os,library) |
| image-list | FILE | · | list of images, one per line, to be scanned |
| skip-files | STRING | --skip-files | file paths to skip during traversal |
| no-progress | BOOLEAN | --no-progress | suppress the progress bar (default false) |
| removed-pkgs | BOOLEAN | --removed-pkgs | detect vulnerabilities in removed packages, Alpine only (default false) |
| ignore-policy | FILE | --ignore-policy | Rego file used to evaluate each vulnerability |
| list-all-pkgs | BOOLEAN | --list-all-pkgs | output all packages regardless of vulnerability (default false) |
| ignore-unfixed | BOOLEAN | --ignore-unfixed | display only vulnerabilities that have a fix (default false) |
| skip-db-update | BOOLEAN | --skip-db-update | skip updating the vulnerability database (default false) |
| aws-credentials | FILE | · | ECR login as AWS_ACCESS_KEY_ID:AWS_SECRET_ACCESS_KEY:AWS_DEFAULT_REGION (colon-separated) |
| security-checks | STRING | --security-checks | comma-separated security issues to detect: vuln, config (default vuln) |
example
Run trivy-ecr-scan
# fail the build on fixable HIGH/CRITICAL CVEs in an ECR imagetrivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 \ 111122223333.dkr.ecr.us-east-1.amazonaws.com/example/api:latestexample/api:latest (debian 12.4)Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 4, CRITICAL: 1) ┌──────────┬────────────────┬──────────┬──────────┬───────────────┬──────────────────────────────┐│ Library │ Vulnerability │ Severity │ Status │ Installed Ver │ Title │├──────────┼────────────────┼──────────┼──────────┼───────────────┼──────────────────────────────┤│ libssl3 │ CVE-2024-6119 │ HIGH │ fixed │ 3.0.11-1 │ openssl: denial of service ││ libc6 │ CVE-2023-4911 │ CRITICAL │ fixed │ 2.36-9 │ glibc: buffer overflow ld.so ││ zlib1g │ CVE-2023-45853 │ HIGH │ affected │ 1.2.13.dfsg-1 │ zlib: integer overflow │└──────────┴────────────────┴──────────┴──────────┴───────────────┴──────────────────────────────┘guidance
Choosing trivy-ecr-scan
Use when your images live in Amazon ECR and you want them scanned with AWS login handled in the node. For images in Docker Hub, another registry, or local lists, use trivy-image-scan.
trivy-image-scan
Scans images from any registry or locally. Use it when the images are not in ECR.
trufflehog
Hunts secrets in code and artifacts. Pair it with Trivy when you need credential leaks alongside CVEs.
nuclei
Tests running services for issues. Trivy inspects image contents; the two cover different layers.
faq
trivy-ecr-scan questions
related
More Containers tools
Run trivy-ecr-scan yourself
An image list and ECR credentials feed trivy-ecr-scan, which pulls each image, scans it for CVEs, and writes the vulnerabilities as an output.
Facts on this page come from the live Trickest tool library.