> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Scanning Images from AWS ECR

> Configure RAD Security to scan container images from Amazon Elastic Container Registry

RAD Security creates a comprehensive SBOM (Software Bill of Materials) for your container images compiled within your cluster infrastructure. The `rad-sbom` plugin downloads images from registry APIs and requires authentication for private repositories.

ECR uses short-lived 12-hour tokens, so `rad-sbom` cannot use standard `imagePullSecrets`. Instead, an IAM role with the necessary permissions must be attached to the service account named `rad-sbom`.

## Configuring Authentication for ECR

There are two approaches to configure authentication:

1. **EKS Pod Identity** - [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html)
2. **IRSA** - [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)

## IAM Policy

Create an IAM policy with the following permissions:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:DescribeImageScanFindings",
        "ecr:GetLifecyclePolicyPreview",
        "ecr:GetDownloadUrlForLayer",
        "ecr:DescribeImageReplicationStatus",
        "ecr:ListTagsForResource",
        "ecr:ListImages",
        "ecr:BatchGetRepositoryScanningConfiguration",
        "ecr:BatchGetImage",
        "ecr:DescribeImages",
        "ecr:DescribeRepositories",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetRepositoryPolicy",
        "ecr:GetLifecyclePolicy",
        "ecr:GetAuthorizationToken"
      ],
      "Resource": "*"
    }
  ]
}
```

## EKS Pod Identity

Create a Pod Identity Association for the `rad-sbom` service account:

<Frame>
  <img src="https://mintcdn.com/radsecurity/g_Ce3ate_usIv2RU/rad-security/platform/tutorials/images/ecr-pod-identity.png?fit=max&auto=format&n=g_Ce3ate_usIv2RU&q=85&s=f18d34c3b930195fd556b1904e5303e4" alt="EKS Pod Identity Association" width="1339" height="790" data-path="rad-security/platform/tutorials/images/ecr-pod-identity.png" />
</Frame>

<Frame>
  <img src="https://mintcdn.com/radsecurity/g_Ce3ate_usIv2RU/rad-security/platform/tutorials/images/ecr-service-account.png?fit=max&auto=format&n=g_Ce3ate_usIv2RU&q=85&s=07f9e48f2efbbf4d3b2f7b84e12938ea" alt="Service Account Association" width="838" height="833" data-path="rad-security/platform/tutorials/images/ecr-service-account.png" />
</Frame>

## IRSA

If using IRSA instead of EKS Pod Identity, add the following annotation to your `values.yaml`:

```yaml theme={null}
sbom:
  serviceAccountAnnotations:
    eks.amazonaws.com/role-arn: <IAM_ROLE_ARN>
```