[AGENTLESS] ECR documentation #27721

jinroh · 2025-02-20T09:52:50Z

What does this PR do? What is the motivation?

Update documentation to prepare for GA of ECR scanning via Agentless.

Merge instructions

Merge readiness:

Ready for merge

Merge queue is enabled in this repo. To have it automatically merged after it receives the required reviews, create the PR (from a branch that follows the <yourname>/description naming convention) and then add the following PR comment:

github-actions · 2025-02-20T09:56:20Z

Preview links (active after the `build_preview` check completes)

Modified Files

rtrieu

Some minor feedback to comply with our style guide, but otherwise looks good. Thank you!

rtrieu · 2025-02-20T15:28:59Z

content/en/security/cloud_security_management/agentless_scanning/_index.md

-3. The scanner creates snapshots of volumes used in running VM instances. These snapshots serve as the basis for conducting scans. Using the snapshots, or the code, the scanner generates a list of packages.
-4. After the scan is complete, the list of packages and information related to collected hosts are transmitted to Datadog, with all other data remaining within your infrastructure. Snapshots created during the scan cycle are deleted.
-5. Leveraging the collected package list along with Datadog's access to the Trivy vulnerabilities database, Datadog finds matching affected vulnerabilities in your resources and code.
+3. For Container Images from registries, the scanners will scan images from all running tasks, by pulling the layers from the registries using standard OCI APIs.


Suggested change

3. For Container Images from registries, the scanners will scan images from all running tasks, by pulling the layers from the registries using standard OCI APIs.

3. For Container Images from registries, the scanners scan images from all running tasks, by pulling the layers from the registries using standard OCI APIs.

rtrieu · 2025-02-20T15:29:58Z

content/en/security/cloud_security_management/agentless_scanning/compatibility.md

+- AWS ECR public
+- AWS ECR private
+
+**Note**: container image scanning from registry is only supported if you have installed agentless with:


Suggested change

**Note**: container image scanning from registry is only supported if you have installed agentless with:

**Note**: Container image scanning from registry is only supported if you have installed Agentless with:

rtrieu · 2025-02-20T15:34:33Z

content/en/security/cloud_security_management/setup/agentless_scanning/_index.md

@@ -20,7 +20,7 @@ Agentless Scanning provides visibility into vulnerabilities that exist within yo
 Before setting up Agentless Scanning, ensure the following prerequisites are met:

 - **Remote Configuration**: [Remote Configuration][3] is required to enable Datadog to send information to Agentless scanners, such as which cloud resources to scan.
- **Cloud permissions**: The Agentless Scanning instance requires specific permissions to scan hosts, containers, and functions. These permissions are automatically applied as part of the installation process.<br><br>
+- **Cloud permissions**: The Agentless Scanning instance requires specific permissions to scan hosts, host images, container registries and functions. These permissions are automatically applied as part of the installation process.<br><br>


Suggested change

- **Cloud permissions**: The Agentless Scanning instance requires specific permissions to scan hosts, host images, container registries and functions. These permissions are automatically applied as part of the installation process.<br><br>

- **Cloud permissions**: The Agentless Scanning instance requires specific permissions to scan hosts, host images, container registries, and functions. These permissions are automatically applied as part of the installation process.<br><br>

rtrieu · 2025-02-20T15:35:07Z

content/en/security/cloud_security_management/setup/agentless_scanning/quick_start.md

@@ -28,7 +28,7 @@ For existing users who want to add a new AWS account or enable Agentless Scannin
 1. Select the AWS region where you want to create the CloudFormation stack.
 1. Select an API key that is already configured for Remote Configuration. If the API key you select does not have Remote Configuration enabled, Remote Configuration is automatically enabled for that key upon selection.
 1. **Send AWS Logs to Datadog** and **Detect security issues** are automatically selected by default. Leave the selections as-is.
-1. The **Enable Vulnerability Management (Host, Container and Lambda)** switch is also enabled by default. Leave this selection as-is.
+1. The **Enable Vulnerability Management (Host, Image Registries, Container and Lambda)** switch is also enabled by default. Leave this selection as-is.


Suggested change

1. The **Enable Vulnerability Management (Host, Image Registries, Container and Lambda)** switch is also enabled by default. Leave this selection as-is.

1. The **Enable Vulnerability Management (Host, Image Registries, Container, and Lambda)** switch is also enabled by default. Leave this selection as-is.

janine-c · 2025-02-20T19:07:56Z

content/en/security/cloud_security_management/agentless_scanning/_index.md

+
+4. The scanner creates snapshots of volumes used in running VM instances. These snapshots serve as the basis for conducting scans. Using the snapshots, or the code, the scanner generates a list of packages.
+5. After the scan is complete, the list of packages and information related to collected hosts are transmitted to Datadog, with all other data remaining within your infrastructure. Snapshots created during the scan cycle are deleted.
+6. Leveraging the collected package list along with Datadog's access to the Trivy vulnerabilities database, Datadog finds matching affected vulnerabilities in your resources and code.


Suggested change

6. Leveraging the collected package list along with Datadog's access to the Trivy vulnerabilities database, Datadog finds matching affected vulnerabilities in your resources and code.

6. Using the collected package list, along with Datadog's access to the Trivy vulnerabilities database, Datadog finds matching affected vulnerabilities in your resources and code.

jinroh added 5 commits February 20, 2025 10:19

agentless: CMK are supported

9b22afb

agentless: add ECR support in overview

1f42e3e

agentless: add registry section in compat matrix

e9e7b23

agentless: remove preview for ECR

ff48b5b

agentless: setup: describe ECR permissions

f021de2

jinroh requested a review from a team as a code owner February 20, 2025 09:52

jinroh changed the title ~~Jinroh/agentless ecr~~ [AGENTLESS] ECR documentation Feb 20, 2025

rtrieu requested changes Feb 20, 2025

View reviewed changes

janine-c reviewed Feb 20, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[AGENTLESS] ECR documentation #27721

[AGENTLESS] ECR documentation #27721

jinroh commented Feb 20, 2025

github-actions bot commented Feb 20, 2025

rtrieu left a comment

rtrieu Feb 20, 2025 •

edited by janine-c

Loading

rtrieu Feb 20, 2025

rtrieu Feb 20, 2025

rtrieu Feb 20, 2025

janine-c Feb 20, 2025

	3. For Container Images from registries, the scanners will scan images from all running tasks, by pulling the layers from the registries using standard OCI APIs.
	3. For Container Images from registries, the scanners scan images from all running tasks, by pulling the layers from the registries using standard OCI APIs.

	Note: container image scanning from registry is only supported if you have installed agentless with:
	Note: Container image scanning from registry is only supported if you have installed Agentless with:

	- Cloud permissions: The Agentless Scanning instance requires specific permissions to scan hosts, host images, container registries and functions. These permissions are automatically applied as part of the installation process.<br><br>
	- Cloud permissions: The Agentless Scanning instance requires specific permissions to scan hosts, host images, container registries, and functions. These permissions are automatically applied as part of the installation process.<br><br>

	1. The Enable Vulnerability Management (Host, Image Registries, Container and Lambda) switch is also enabled by default. Leave this selection as-is.
	1. The Enable Vulnerability Management (Host, Image Registries, Container, and Lambda) switch is also enabled by default. Leave this selection as-is.

	6. Leveraging the collected package list along with Datadog's access to the Trivy vulnerabilities database, Datadog finds matching affected vulnerabilities in your resources and code.
	6. Using the collected package list, along with Datadog's access to the Trivy vulnerabilities database, Datadog finds matching affected vulnerabilities in your resources and code.

[AGENTLESS] ECR documentation #27721

Are you sure you want to change the base?

[AGENTLESS] ECR documentation #27721

Conversation

jinroh commented Feb 20, 2025

What does this PR do? What is the motivation?

Merge instructions

github-actions bot commented Feb 20, 2025

Preview links (active after the build_preview check completes)

Modified Files

rtrieu left a comment

Choose a reason for hiding this comment

rtrieu Feb 20, 2025 • edited by janine-c Loading

Choose a reason for hiding this comment

rtrieu Feb 20, 2025

Choose a reason for hiding this comment

rtrieu Feb 20, 2025

Choose a reason for hiding this comment

rtrieu Feb 20, 2025

Choose a reason for hiding this comment

janine-c Feb 20, 2025

Choose a reason for hiding this comment

Preview links (active after the `build_preview` check completes)

rtrieu Feb 20, 2025 •

edited by janine-c

Loading