> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/vulnerability-management/vm-image-scanning.md). # Configure VM Image Scanning Prisma Cloud supports scanning VM images on AWS, Azure, and GCP. On AWS, Prisma Cloud can scan Linux Amazon Machine Images (AMIs). On Azure, Prisma Cloud supports Managed, Gallery, and Marketplace images. On GCP, Prisma Cloud supports Public and Custom images (including Premium images). VM image scanning is handled by the Console and does not require Defenders. The Prisma Cloud Console scans a VM image by launching or creating a VM instance that is running the VM image that you want to scan. When you set up Prisma Cloud to scan VM images, you can choose how many scanners to use. For scanning a large number of VM images, increase the number of scanners to scan multiple VM images simultaneously for improved throughput and reduced scan time. The VM instances created for scanning VM Images come with default tags: Key - Name, Value - prismacloud-scan-\* ## AWS The following AMIs aren’t supported: * ARM64 AMI VM images; only x86 AMI VM Images are supported * Images that don’t use cloud-init for bootstrapping, such as Red Hat Enterprise Linux CoreOS (CoreOS for OpenShift). RHCOS uses Ignition. * Images that use paravirtualization. * Images that only support old TLS protocols (less than TLS 1.1) for utilities such as curl. For example, Ubuntu 12.10. ### Prerequisites * Access from the VPC to the Prisma Cloud Compute Console. * The service account Prisma Cloud uses to scan AMIs must have at least the following policy: ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "PrismaCloudComputeAMIScanning", "Effect": "Allow", "Action": [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances" ], "Resource": "*" } ] } ``` Prisma Cloud requires the permissions listed above for VM image scanning. To restrict permissions for creating and deleting resources, you can use conditional clauses in AWS IAM policy for the security groups and instances that have the prefix "prismacloud-scan". It is strongly recommended to make sure the images scanned have DeleteOnTermination attribute enabled. ## Azure Prisma Cloud supports the following image types: * Marketplace images (publicly available images) * Managed (custom) images * Shared image galleries * Encrypted images * Azure Linux images Prisma Cloud doesn’t support the following image types: * Azure paid images ### Prerequisites * The service account Prisma Cloud uses to scan Azure images must have at least the following policy: ``` Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/versions/read Microsoft.Compute/images/read Microsoft.Compute/galleries/read Microsoft.Compute/galleries/images/read Microsoft.Compute/galleries/images/versions/read Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Resources/subscriptions/resourceGroups/write Microsoft.Resources/subscriptions/resourceGroups/delete Microsoft.Network/networkSecurityGroups/read Microsoft.Network/networkSecurityGroups/write Microsoft.Network/networkSecurityGroups/join/action Microsoft.Network/networkSecurityGroups/delete Microsoft.Network/networkInterfaces/read Microsoft.Network/networkInterfaces/write Microsoft.Network/networkInterfaces/join/action Microsoft.Network/networkInterfaces/delete Microsoft.Compute/disks/write Microsoft.Compute/disks/delete Microsoft.Network/virtualNetworks/subnets/read Microsoft.Network/virtualNetworks/subnets/join/action Microsoft.Compute/virtualMachines/read Microsoft.Compute/virtualMachines/write Microsoft.Compute/virtualMachines/start/action Microsoft.Compute/virtualMachines/delete Microsoft.KeyVault/vaults/keys/read Microsoft.KeyVault/vaults/keys/wrap/action Microsoft.KeyVault/vaults/keys/unwrap/action ``` To scan encrypted images, use the Azure `Key Vault Crypto Service Encryption User` built-in role. If you have managed and gallery images limited to specific regions, Prisma Cloud skips the scan when the region defined in the scope doesn’t match the region defined for the image. ## GCP Prisma Cloud supports the following image types: * Public images (including Premium images) * Custom images * Encrypted images ### Prerequisites You can only scan encrypted images that use a customer-managed encryption key (CMEK). Customer-supplied encryption keys (CSEK) are not supported. * The service account Prisma Cloud uses to scan GCP VM images must have at least the following policy: ``` compute.disks.create compute.images.get compute.images.list compute.images.useReadOnly compute.instances.create compute.instances.delete compute.instances.get compute.instances.list compute.instances.setMetadata compute.instances.setTags compute.networks.updatePolicy compute.networks.use compute.networks.useExternalIp compute.subnetworks.use compute.subnetworks.useExternalIp ``` * Verify that the Compute Engine Service Agent service account in the target image project has the `Cloud KMS CryptoKey Decrypter` role or equivalent. * If you use a shared VPC, verify that the service account in the target image project has the `compute.subnetworks.use` permission in the project containing the subnetwork. For a shared VPC, the project containing the shared VPC is the host project. This [built-in service account](https://cloud.google.com/iam/docs/service-agents) ends with `compute-system.iam.gserviceaccount.com`. The service agent has these permissions by default since it used these permissions to encrypt the images. ## VM Image Scans If you remove a VM image, or it becomes unavailable, Prisma Cloud maintains the scan results for 30 days. After 30 days, the scan results are automatically deleted. When a scan is canceled, it might take a few minutes for the scan to stop completely. On Console upgrade, VM image scanning results from the previous Console version are deleted. 1. Open Console. 2. Go to **Defend > Vulnerabilities/Compliance > Hosts > VM Images**. 3. Select **Add Scope**. Define the scan settings. **Scan Settings** | **FIELD** | **DESCRIPTION** | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Provider | Specify the cloud provider. The supported providers are AWS, Azure, and GCP. | | Credential | Specify the credential required to access the VM images and launch the VM instance on the Cloud Service Provider. | | Project ID (GCP only) | Specify the project ID where the service account was created. | | Image type (Azure only) | Specify the relevant image type. Prisma Cloud supports three image types: Managed, Gallery, and Marketplace. | | Images |

Specify the VM images to scan. Leave \* to scan all images.

NOTE: On AWS, when the image field contains a string and a wildcard (e.g. Amazo\*), only private AMIs are scanned. When using explicit image names, AWS Marketplace, and community AMIs are scanned as well. Only the AMI names are permitted in the image field. AMI IDs are not supported.

Use the label field in the referenced collection to restrict the scan for the specified label on the VM Image. Use the key-value pattern 'key:value'.

All supported resource fields support pattern matching.

| | Excluded VM images | Specify VM images to exclude from the scan. This field supports [pattern matching](/admin-guide/configure/rule-ordering-pattern-matching.md). | | Region (AWS and Azure) | Specify the region to scan. | | Console address | Specify the Console URL for the scanner VM instance to use. | | Zone (GCP only) | Specify the Zone where scan instances will be deployed. | | Number of scanners | Specify the number of VM images to concurrently scan. Increase the number of scanners to increase throughput and reduce scan time. | | Cap | Choose the maximum number of VM images you want to scan, and they will be sorted based on their 'Creation Date.' Scanning begins with the most recently created VM images and proceeds in descending order of creation date. In the case of Azure Marketplace and Managed images, the images are scanned according to their resource ID, in descending lexicographic order (i.e., ID3, then ID2, then ID1). To scan all VM images, set value to 0. | | VPC ID and Subnet ID (AWS only) |

If you want a custom VPC for the scanner VM instance, specify the VPC id to use (e.g., vpc-xxxxx). If you want a custom subnet for the scanner VM instance, specify the subnet id to use (e.g., subnet-xxxxx).

NOTE: VPC ID and subnet ID are mapped 1:1. You can only scope one VPC and subnet for a rule.

| | Subnet (GCP only) | If you want a custom subnet for the scanner VM instance, specify the subnet name. | | Subnet Resource ID (Azure only) | Specify the Resource ID of the subnet where scan instances should be deployed. | | Instance Type | For AWS, the default is m4.large. For Azure, the default is standard\_D2s\_v4. For GCP, the default is e2-standard-2. | | Enable Secure boot (GCP only) | Enable the option to verify the digital signature with secure boot for the temporary VM instance created for VM image scanning. | ## Add Rule for Scanning VM Images To define which VM images to scan, create a new VM images scan rule. 1. Open Console. 2. Go to **Defend > Vulnerabilities/Compliance > Hosts > VM Images**. 3. Select **Add Rule**. 4. Specify the thresholds for vulnerabilities or compliance. 5. Select **Save**. ## Additional scan settings Additional scan settings can be found under **Manage > System > Scan**, where you can set the [VM images scan interval](/admin-guide/configure/configure-scan-intervals.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/admin-guide/vulnerability-management/vm-image-scanning.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.