> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/agentless-scanning/configure-accounts/configure-aws.md).
# Configure Agentless Scanning for AWS
Prisma Cloud gives you the flexibility to choose between agentless security and agent-based security using Defenders. Agentless scanning lets you inspect the risks and vulnerabilities of a cloud workload or container image without installing an agent or affecting the execution of your workload. Prisma Cloud supports agentless scanning for vulnerabilities and compliance on AWS hosts, containers, and clusters. To learn more about how agentless scanning works, see the [How Agentless Scanning Works?](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/agentless-scanning.md)\[How Agentless Scanning Works?]
When you [onboard your AWS account](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/connect/connect-cloud-accounts/onboard-aws/onboard-aws.md), you can enable agentless scanning. Complete the steps below to configure agentless scanning based on the needs of your deployment.
## Configure Agentless Scanning
1. Log in to Prisma Cloud Runtime Security.
2. Select **Runtime Security > Manage > Cloud Accounts**.
3. Click the edit button of your cloud account.
4. Go to the **Agentless Scanning** section.
5. **Hub account**: Enable the toggle to configure this account as a [hub account](/content-collections/runtime-security/agentless-scanning/agentless-scanning-modes.md).
6. Expand the **Advanced settings** and provide the appropriate values based on your deployment for the following items.
7. Click **Save** to return to **Compute > Manage > Cloud accounts**.
Agentless scanning enforces boot volume encryption by default.
### Scan Settings
**Select where to scan**: For AWS accounts, you can decide between [two scanning modes](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/agentless-scanning.md#scanning-modes).
* **Same Account**: Perform the agentless scanning process using this account.
* **Hub Account**: Perform the agentless scanning process using a centralized hub account. Select another account from the list to use as the centralized hub account to scan this account.
### Auto-scale scanning
Automatically create the required amount of scanners to scan all of the hosts within a region, up to a limit of 50 scanners. To use a different limit specify the **Max number of scanners**.
**Max number of scanners**: Enter the upper limit of scanners that Prisma Cloud can automatically spin up within a region in your account for faster results.
### Enforce Permissions Check
When enabled, this account isn’t scanned in case of failure to validate the required permissions.
When disabled, the pre-scan check to validate permissions is skipped. If permissions are missing or blocked by an organizational policy, the scan fails at that stage.
Review the [needed permissions to enable agentless scanning in AWS](/content-collections/runtime-security/configure/permissions.md#aws-agentless).
### Proxy
Enter a **Proxy** value if traffic leaving your AWS tenant uses a proxy.
Provide the proxy’s CA certificate.
### Custom Tags
Apply custom tags to any resources Prisma Cloud creates during agentless scanning.
### Scan Scope
Under **Scan scope** you can refine the scope of the scanning by **Regions** or using tags.
* **All regions**: Scan in all AWS regions.
* **Custom regions**: Specify the AWS regions, which you want scanned.
* **Scan non running hosts**: Choose whether or not to scan hosts that aren’t running.
* **Exclude hosts by tags**: Select a subset of hosts which you want to exclude from the scan process
You can use wildcards to specify a range of tags in both keys and values following these examples:
```
"abcd*"
"*abcd"
"abcd"
"*"
"*abcd*"
```
* **Include hosts by tags**: Select a subset of hosts to scan
You can use wildcards to specify a range of tags in both keys and values following these examples:
```
"abcd*"
"*abcd"
"abcd"
"*"
"*abcd*"
```
### Network Resources
Configure custom network resources for agentless scanning. When using custom network resources, Prisma Cloud assumes those resources have a path to communicate outbound data to the Prisma Cloud backend, as explained in the [networking infrastructure section](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/agentless-scanning.md#networking-infrastructure).
* **Subnet name**: the name tag of the subnet resource in your AWS account. If the subnet allows auto-assignment of public IPs, a public IP will be attached to the scanner instance. Subnet names should be identical and unique across all regions.
* **Security group name**: the name of the security group resource in your AWS account. Security group names should be identical and unique across all regions.
The following combinations are possible for the network resources.
* If you leave both fields blank, Prisma Cloud creates all required network resources and uses a public IP as explained in the [networking infrastructure section](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/agentless-scanning.md#networking-infrastructure).
* If you configure both fields, Prisma Cloud validates that both resources exist and are using the same VPC.
* If you only configure the **Security group name**, Prisma Cloud uses the configured security group and attaches a random subnet and VPC to that security group.
* If you only configure the **Subnet name**, Prisma Cloud validates that the subnet exists and assumes that all required network resources exist and are attached to that subnet. Prisma Cloud uses the default security group created by AWS for that subnet.
## Resource Tagging
This section lists the conventions used for identifying resources that are created by agentless scanning in Amazon Web Services (AWS). These conventions ensure that resources are effectively managed and uniformly identified in AWS cloud environments.
In Amazon Web Services (AWS), tags are used to identify resources created by agentless scanning. Here are the details for various types of resources.
**Agentless Scanner VMs**
* Name format: `prismacloud-scan-`
* Tags:
* `created-by: prismacloud-agentless-scan`
* `Name: prismacloud-scan-`
* `prismacloud-agentless-unique-id: `
`scan-unique-id` is a unique identifier generated for each scan. It changes with every scan, resulting in a distinct name for the resources created during that scan.
`console-unique-id` is a unique number associated with each console. For Prisma Cloud SaaS customers, it remains constant even after upgrades. For on-premises setups, it may change if a new console is created without using data from the previous console. This ID is used to track resources and facilitate their cleanup after the scan is completed.
**Security Groups (SG)**
* Name format: `sg--prismacloud-scan-`
* Tags: Not applicable
sg-ID is an AWS ID generated during agentless scanning. It is derived from the `scan-unique-id` and `console-unique-id`. If these IDs are missing, the SG-ID value will remain empty.
**Subnets**
* Name format: `subnet- / prismacloud-scan-`
* Tags:
* `created-by: prismacloud-agentless-scan`
* `Name: prismacloud-scan-`
`subnetId` is the identifier for a subnet within the cloud environment.
**Snapshots**
* Name format: `snap-(prismacloud-scan-)`
* Tags:
* `created-by: prismacloud-agentless-scan`
* `Name: prismacloud-scan-`
* `prismacloud-agentless-unique-id: `
`snapshotId` is the identifier for a snapshot, a point-in-time copy of a resource in the cloud environment.
**Volumes**
Volumes are not tagged by Prisma Cloud.
## Known Limitations
* **LVM-based AMIs:** Due to the lack of an official LVM-based Amazon Machine Image (AMI) on AWS, agentless scanning might not recognize and scan AMIs using a non-standard LVM configuration. These AMIs will currently not be supported for agentless scanning.
* **Unsupported Marketplace AMIs:** Certain AMIs available on the AWS Marketplace are configured in a way that prohibits mounting them as secondary volumes. Consequently, agentless scanning is not compatible with these AMIs. If scanning is essential for such hosts, please contact the vendor of the specific AMI to request a configuration change that will enable agentless to scan instances launched from that AMI, by removing that limitation.
## Troubleshooting
AWS has a default limit of 5 VPCs per account. If your account currently maintains the default maximum of 5 VPCs and the default limit remains unaltered, Prisma Cloud encounters an issue preventing it from establishing its standard VPC, ultimately leading to an error. To solve this issue, please access your AWS account and modify the VPC limit.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/runtime-security/agentless-scanning/configure-accounts/configure-aws.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.