# API Reference
## Constructs
### ImageScannerWithTrivy
A Construct that scans container images with Trivy.
It uses a Lambda function as a Custom Resource provider to run Trivy and scan container images.
#### Initializers
```typescript
import { ImageScannerWithTrivy } from 'image-scanner-with-trivy'
new ImageScannerWithTrivy(scope: Construct, id: string, props: ImageScannerWithTrivyProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| scope | constructs.Construct | *No description.* |
| id | string | *No description.* |
| props | ImageScannerWithTrivyProps | *No description.* |
---
##### `scope`Required
- *Type:* constructs.Construct
---
##### `id`Required
- *Type:* string
---
##### `props`Required
- *Type:* ImageScannerWithTrivyProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| toString | Returns a string representation of this construct. |
---
##### ~~`toString`~~
```typescript
public toString(): string
```
Returns a string representation of this construct.
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| isConstruct | Checks if `x` is a construct. |
---
##### ~~`isConstruct`~~
```typescript
import { ImageScannerWithTrivy } from 'image-scanner-with-trivy'
ImageScannerWithTrivy.isConstruct(x: any)
```
Checks if `x` is a construct.
###### `x`Required
- *Type:* any
Any object.
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| node | constructs.Node | The tree node. |
---
##### ~~`node`~~Required
- *Deprecated:* Use ImageScannerWithTrivyV2 instead. This will be removed in the next major version.
```typescript
public readonly node: Node;
```
- *Type:* constructs.Node
The tree node.
---
### ImageScannerWithTrivyV2
A Construct that scans container images with Trivy.
It uses a Lambda function as a Custom Resource provider to run Trivy and scan container images.
#### Initializers
```typescript
import { ImageScannerWithTrivyV2 } from 'image-scanner-with-trivy'
new ImageScannerWithTrivyV2(scope: Construct, id: string, props: ImageScannerWithTrivyV2Props)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| scope | constructs.Construct | *No description.* |
| id | string | *No description.* |
| props | ImageScannerWithTrivyV2Props | *No description.* |
---
##### `scope`Required
- *Type:* constructs.Construct
---
##### `id`Required
- *Type:* string
---
##### `props`Required
- *Type:* ImageScannerWithTrivyV2Props
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| toString | Returns a string representation of this construct. |
---
##### `toString`
```typescript
public toString(): string
```
Returns a string representation of this construct.
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| isConstruct | Checks if `x` is a construct. |
---
##### ~~`isConstruct`~~
```typescript
import { ImageScannerWithTrivyV2 } from 'image-scanner-with-trivy'
ImageScannerWithTrivyV2.isConstruct(x: any)
```
Checks if `x` is a construct.
###### `x`Required
- *Type:* any
Any object.
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| node | constructs.Node | The tree node. |
---
##### `node`Required
```typescript
public readonly node: Node;
```
- *Type:* constructs.Node
The tree node.
---
## Structs
### CloudWatchLogsOutputOptions
Output configuration for scan logs to CloudWatch Logs.
#### Initializer
```typescript
import { CloudWatchLogsOutputOptions } from 'image-scanner-with-trivy'
const cloudWatchLogsOutputOptions: CloudWatchLogsOutputOptions = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| type | ScanLogsOutputType | The type of scan logs output. |
| logGroupName | string | The name of the CloudWatch Logs log group. |
---
##### `type`Required
```typescript
public readonly type: ScanLogsOutputType;
```
- *Type:* ScanLogsOutputType
The type of scan logs output.
---
##### `logGroupName`Required
```typescript
public readonly logGroupName: string;
```
- *Type:* string
The name of the CloudWatch Logs log group.
---
### CloudWatchLogsOutputProps
Configuration for scan logs output to CloudWatch Logs log group.
#### Initializer
```typescript
import { CloudWatchLogsOutputProps } from 'image-scanner-with-trivy'
const cloudWatchLogsOutputProps: CloudWatchLogsOutputProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| logGroup | aws-cdk-lib.aws_logs.ILogGroup | The log group to output scan logs. |
---
##### `logGroup`Required
```typescript
public readonly logGroup: ILogGroup;
```
- *Type:* aws-cdk-lib.aws_logs.ILogGroup
The log group to output scan logs.
---
### ImageScannerWithTrivyProps
Properties for ImageScannerWithTrivy Construct.
#### Initializer
```typescript
import { ImageScannerWithTrivyProps } from 'image-scanner-with-trivy'
const imageScannerWithTrivyProps: ImageScannerWithTrivyProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| imageUri | string | Image URI for scan target. |
| repository | aws-cdk-lib.aws_ecr.IRepository | Repository including the image URI for scan target. |
| defaultLogGroupRemovalPolicy | aws-cdk-lib.RemovalPolicy | The removal policy to apply to Scanner Lambda's default log group. |
| defaultLogGroupRetentionDays | aws-cdk-lib.aws_logs.RetentionDays | The number of days log events are kept in Scanner Lambda's default log group. |
| exitCode | number | Exit Code. |
| exitOnEol | number | Exit on EOL. |
| ignoreUnfixed | boolean | The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. |
| imageConfigScanners | ImageConfigScanners[] | Enum for ImageConfigScanners. |
| memorySize | number | Memory Size (MB) for Scanner Lambda. |
| platform | string | Scan Image on a specific Architecture and OS. |
| scanLogsOutput | ScanLogsOutput | Configuration for scan logs output. |
| scanners | Scanners[] | Enable/Disable Scanners. |
| severity | Severity[] | Severity Selection. |
| suppressErrorOnRollback | boolean | Suppress errors during rollback scanner Lambda execution. |
| trivyIgnore | string[] | By Finding IDs. |
---
##### ~~`imageUri`~~Required
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly imageUri: string;
```
- *Type:* string
Image URI for scan target.
---
##### ~~`repository`~~Required
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly repository: IRepository;
```
- *Type:* aws-cdk-lib.aws_ecr.IRepository
Repository including the image URI for scan target.
Because of grantPull to CustomResourceLambda.
---
##### ~~`defaultLogGroupRemovalPolicy`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly defaultLogGroupRemovalPolicy: RemovalPolicy;
```
- *Type:* aws-cdk-lib.RemovalPolicy
- *Default:* Scanner Lambda creates the default log group(`/aws/lambda/${functionName}`).
The removal policy to apply to Scanner Lambda's default log group.
If you use ImageScannerWithTrivy construct multiple times in the same stack, you cannot set different removal policies for the default log group.
See `Notes` section in the README for more details.
---
##### ~~`defaultLogGroupRetentionDays`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly defaultLogGroupRetentionDays: RetentionDays;
```
- *Type:* aws-cdk-lib.aws_logs.RetentionDays
- *Default:* Scanner Lambda creates the default log group(`/aws/lambda/${functionName}`) and log events never expire.
The number of days log events are kept in Scanner Lambda's default log group.
If you use ImageScannerWithTrivy construct multiple times in the same stack, you cannot set different retention days for the default log group.
See `Notes` section in the README for more details.
---
##### ~~`exitCode`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly exitCode: number;
```
- *Type:* number
- *Default:* 1
Exit Code.
Use the `exitCode` option if you want to exit with a non-zero exit code.
You can specify 0 if you do not want to exit even when vulnerabilities are detected.
It defaults to 1 IN THIS CONSTRUCT for safety in CI/CD. In the original trivy, it is 0.
> [https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#exit-code](https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#exit-code)
---
##### ~~`exitOnEol`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly exitOnEol: number;
```
- *Type:* number
- *Default:* 1
Exit on EOL.
Sometimes you may surprisingly get 0 vulnerabilities in an old image:
- Enabling --ignore-unfixed option while all packages have no fixed versions.
- Scanning a rather outdated OS (e.g. Ubuntu 10.04).
An OS at the end of service/life (EOL) usually gets into this situation, which is definitely full of vulnerabilities.
`exitOnEol` can fail scanning on EOL OS with a non-zero code.
It defaults to 1 IN THIS CONSTRUCT for safety in CI/CD. In the original trivy, it is 0.
> [https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#exit-on-eol](https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#exit-on-eol)
---
##### ~~`ignoreUnfixed`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly ignoreUnfixed: boolean;
```
- *Type:* boolean
- *Default:* false
The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution.
To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag.
> [https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#unfixed-vulnerabilities](https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#unfixed-vulnerabilities)
---
##### ~~`imageConfigScanners`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly imageConfigScanners: ImageConfigScanners[];
```
- *Type:* ImageConfigScanners[]
- *Default:* []
Enum for ImageConfigScanners.
Container images have configuration. docker inspect and `docker history` show the information according to the configuration.
Trivy scans the configuration of container images for
- Misconfigurations
- Secrets
They are disabled by default. You can enable them with `imageConfigScanners`.
> [https://aquasecurity.github.io/trivy/latest/docs/target/container_image/#container-image-metadata](https://aquasecurity.github.io/trivy/latest/docs/target/container_image/#container-image-metadata)
---
##### ~~`memorySize`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly memorySize: number;
```
- *Type:* number
- *Default:* 3008
Memory Size (MB) for Scanner Lambda.
You can specify between `3008` and `10240`.
If this Construct execution terminates abnormally due to SIGKILL, try a larger size.
Default value (`3008` MB) is Maximum Lambda memory size for default AWS account without quota limit increase.
---
##### ~~`platform`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly platform: string;
```
- *Type:* string
- *Default:*
Scan Image on a specific Architecture and OS.
By default, Trivy loads an image on a `linux/amd64` machine.
To customize this, pass a `platform` argument in the format OS/Architecture for the image, such as `linux/arm64`
---
##### ~~`scanLogsOutput`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly scanLogsOutput: ScanLogsOutput;
```
- *Type:* ScanLogsOutput
- *Default:* scan logs output to default log group created by Scanner Lambda(`/aws/lambda/${functionName}`)
Configuration for scan logs output.
By default, scan logs are output to default log group created by Scanner Lambda.
Specify this if you want to send scan logs to other than the default log group.
Currently, only `cloudWatchLogs` is supported.
---
##### ~~`scanners`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly scanners: Scanners[];
```
- *Type:* Scanners[]
- *Default:* [Security.VULN,Scanners.SECRET]
Enable/Disable Scanners.
You can enable/disable scanners with the `scanners`.
For example, container image scanning enables vulnerability (VULN) and secret scanners (SECRET) by default.
If you don't need secret scanning, it can be disabled by specifying Scanners.VULN only.
> [https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#enabledisable-scanners](https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#enabledisable-scanners)
---
##### ~~`severity`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly severity: Severity[];
```
- *Type:* Severity[]
- *Default:* [Severity.CRITICAL]
Severity Selection.
The severity is taken from the selected data source since the severity from vendors is more accurate.
Using CVE-2023-0464 as an example, while it is rated as "HIGH" in NVD, Red Hat has marked its 'Impact' as "Low". As a result, Trivy will display it as "Low".
The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software.
Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD.
It defaults to `CRITICAL` IN THIS CONSTRUCT for safety in CI/CD, but the default configuration of Trivy is "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN".
> [https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#severity-selection](https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#severity-selection)
---
##### ~~`suppressErrorOnRollback`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly suppressErrorOnRollback: boolean;
```
- *Type:* boolean
- *Default:* true
Suppress errors during rollback scanner Lambda execution.
When image scanning fails, CloudFormation triggers a rollback and executes the previous
version of the scanner Lambda. If this property is set to `true`, the previous version of
the scanner Lambda will not throw an error, even if the image scanning for the previous version
fails.
This allows the rollback to complete successfully, avoiding ROLLBACK_FAILED state
when image scanning failures occur.
---
##### ~~`trivyIgnore`~~Optional
- *Deprecated:* Use ImageScannerWithTrivyV2Props instead. This will be removed in the next major version.
```typescript
public readonly trivyIgnore: string[];
```
- *Type:* string[]
- *Default:* []
By Finding IDs.
The ignore rules written to the .trivyignore in trivy.
Put each line you write in the file into one element of the array.
> [https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/#trivyignore](https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/#trivyignore)
---
*Example*
```typescript
$ cat .trivyignore
# Accept the risk
CVE-2018-14618
# Accept the risk until 2023-01-01
CVE-2019-14697 exp:2023-01-01
# No impact in our settings
CVE-2019-1543
# Ignore misconfigurations
AVD-DS-0002
# Ignore secrets
generic-unwanted-rule
aws-account-id
```
### ImageScannerWithTrivyV2Props
Properties for ImageScannerWithTrivyV2 Construct.
#### Initializer
```typescript
import { ImageScannerWithTrivyV2Props } from 'image-scanner-with-trivy'
const imageScannerWithTrivyV2Props: ImageScannerWithTrivyV2Props = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| imageUri | string | Image URI for scan target. |
| repository | aws-cdk-lib.aws_ecr.IRepository | Repository including the image URI for scan target. |
| blockConstructs | constructs.IConstruct[] | Constructs to block if vulnerabilities are detected. |
| defaultLogGroup | aws-cdk-lib.aws_logs.ILogGroup | The Scanner Lambda function's default log group. |
| failOnVulnerability | boolean | Whether to fail on vulnerabilities or EOL (End of Life) images. |
| ignoreUnfixed | boolean | The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. |
| imageConfigScanners | ImageConfigScanners[] | Enum for ImageConfigScanners. |
| memorySize | number | Memory Size (MB) for Scanner Lambda. |
| scanLogsOutput | ScanLogsOutput | Configuration for scan logs output. |
| scanners | Scanners[] | Enable/Disable Scanners. |
| severity | Severity[] | Severity Selection. |
| suppressErrorOnRollback | boolean | Suppress errors during rollback scanner Lambda execution. |
| targetImagePlatform | TargetImagePlatform | Scan Image on a specific Architecture and OS. |
| trivyIgnore | TrivyIgnore | Ignore rules or ignore file for Trivy. |
| vulnsNotificationTopic | aws-cdk-lib.aws_sns.ITopic | SNS topic for vulnerabilities notification. |
---
##### `imageUri`Required
```typescript
public readonly imageUri: string;
```
- *Type:* string
Image URI for scan target.
---
##### `repository`Required
```typescript
public readonly repository: IRepository;
```
- *Type:* aws-cdk-lib.aws_ecr.IRepository
Repository including the image URI for scan target.
Because of grantPull to CustomResourceLambda.
---
##### `blockConstructs`Optional
```typescript
public readonly blockConstructs: IConstruct[];
```
- *Type:* constructs.IConstruct[]
- *Default:* no constructs to block
Constructs to block if vulnerabilities are detected.
This is equivalent to calling `construct.node.addDependency(imageScanner)` for each construct.
Note: This option only works when `failOnVulnerability` is `true` (default).
If `failOnVulnerability` is set to `false`, the scanner will not fail on vulnerabilities,
and the specified constructs will not be blocked.
---
##### `defaultLogGroup`Optional
```typescript
public readonly defaultLogGroup: ILogGroup;
```
- *Type:* aws-cdk-lib.aws_logs.ILogGroup
- *Default:* Scanner Lambda creates the default log group(`/aws/lambda/${functionName}`).
The Scanner Lambda function's default log group.
If you use ImageScannerWithTrivyV2 construct multiple times in the same stack,
you must specify the same log group for each construct.
See `Default Log Group` section in the README for more details.
---
##### `failOnVulnerability`Optional
```typescript
public readonly failOnVulnerability: boolean;
```
- *Type:* boolean
- *Default:* true
Whether to fail on vulnerabilities or EOL (End of Life) images.
If set to `true`, Trivy exits with a non-zero exit code when vulnerabilities or EOL images are detected.
If set to `false`, Trivy exits with a zero exit code even when vulnerabilities or EOL images are detected.
It defaults to `true` IN THIS CONSTRUCT for safety in CI/CD. In the original trivy, it is `false` (exit code 0).
**Note**: When `sbomFormat` is specified in `scanLogsOutput.s3()`, SBOM generation mode is used instead of
vulnerability scanning. In SBOM mode, Trivy always exits with code 0 regardless of this setting, and
no SNS notifications will be sent even if `vulnsNotificationTopic` is configured.
> [https://trivy.dev/docs/latest/configuration/others/#exit-code](https://trivy.dev/docs/latest/configuration/others/#exit-code)
---
##### `ignoreUnfixed`Optional
```typescript
public readonly ignoreUnfixed: boolean;
```
- *Type:* boolean
- *Default:* false
The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution.
To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag.
> [https://trivy.dev/docs/latest/scanner/vulnerability/#unfixed-vulnerabilities](https://trivy.dev/docs/latest/scanner/vulnerability/#unfixed-vulnerabilities)
---
##### `imageConfigScanners`Optional
```typescript
public readonly imageConfigScanners: ImageConfigScanners[];
```
- *Type:* ImageConfigScanners[]
- *Default:* []
Enum for ImageConfigScanners.
Container images have configuration. docker inspect and `docker history` show the information according to the configuration.
Trivy scans the configuration of container images for
- Misconfigurations
- Secrets
They are disabled by default. You can enable them with `imageConfigScanners`.
> [https://trivy.dev/docs/latest/target/container_image/#container-image-metadata](https://trivy.dev/docs/latest/target/container_image/#container-image-metadata)
---
##### `memorySize`Optional
```typescript
public readonly memorySize: number;
```
- *Type:* number
- *Default:* 3008
Memory Size (MB) for Scanner Lambda.
You can specify between `3008` and `10240`.
If this Construct execution terminates abnormally due to SIGKILL, try a larger size.
Default value (`3008` MB) is Maximum Lambda memory size for default AWS account without quota limit increase.
---
##### `scanLogsOutput`Optional
```typescript
public readonly scanLogsOutput: ScanLogsOutput;
```
- *Type:* ScanLogsOutput
- *Default:* scan logs output to `defaultLogGroup` if specified, otherwise to the default log group created by Scanner Lambda.
Configuration for scan logs output.
By default, scan logs are output to default log group created by Scanner Lambda.
Specify this if you want to send scan logs to other than the default log group.
**Note**: CloudWatch Logs has a 1 MB per log event limit. Large scan results will be
automatically split into multiple events with `[part X/Y]` prefixes. **For large scan
results, we recommend using S3 output** to avoid fragmentation and make it easier to
view complete results.
---
##### `scanners`Optional
```typescript
public readonly scanners: Scanners[];
```
- *Type:* Scanners[]
- *Default:* [Security.VULN,Scanners.SECRET]
Enable/Disable Scanners.
You can enable/disable scanners with the `scanners`.
For example, container image scanning enables vulnerability (VULN) and secret scanners (SECRET) by default.
If you don't need secret scanning, it can be disabled by specifying Scanners.VULN only.
> [https://trivy.dev/docs/latest/configuration/others/#enabledisable-scanners](https://trivy.dev/docs/latest/configuration/others/#enabledisable-scanners)
---
##### `severity`Optional
```typescript
public readonly severity: Severity[];
```
- *Type:* Severity[]
- *Default:* [Severity.CRITICAL]
Severity Selection.
The severity is taken from the selected data source since the severity from vendors is more accurate.
Using CVE-2023-0464 as an example, while it is rated as "HIGH" in NVD, Red Hat has marked its 'Impact' as "Low". As a result, Trivy will display it as "Low".
The severity depends on the compile option, the default configuration, etc. NVD doesn't know how the vendor distributes the software.
Red Hat evaluates the severity more accurately. That's why Trivy prefers vendor scores over NVD.
It defaults to `CRITICAL` IN THIS CONSTRUCT for safety in CI/CD, but the default configuration of Trivy is "CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN".
> [https://trivy.dev/docs/latest/scanner/vulnerability/#severity-selection](https://trivy.dev/docs/latest/scanner/vulnerability/#severity-selection)
---
##### `suppressErrorOnRollback`Optional
```typescript
public readonly suppressErrorOnRollback: boolean;
```
- *Type:* boolean
- *Default:* true
Suppress errors during rollback scanner Lambda execution.
When image scanning fails, CloudFormation triggers a rollback and executes the previous
version of the scanner Lambda. If this property is set to `true`, the previous version of
the scanner Lambda will not throw an error, even if the image scanning for the previous version
fails.
This allows the rollback to complete successfully, avoiding ROLLBACK_FAILED state
when image scanning failures occur.
---
##### `targetImagePlatform`Optional
```typescript
public readonly targetImagePlatform: TargetImagePlatform;
```
- *Type:* TargetImagePlatform
- *Default:* Trivy loads an image on a `linux/amd64` machine.
Scan Image on a specific Architecture and OS.
---
##### `trivyIgnore`Optional
```typescript
public readonly trivyIgnore: TrivyIgnore;
```
- *Type:* TrivyIgnore
- *Default:* no ignore rules
Ignore rules or ignore file for Trivy.
Use `TrivyIgnore.fromRules()` to specify inline ignore rules (equivalent to writing lines
in a `.trivyignore` file), or `TrivyIgnore.fromFilePath()` to point to an existing ignore file.
> [https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml](https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml)
---
##### `vulnsNotificationTopic`Optional
```typescript
public readonly vulnsNotificationTopic: ITopic;
```
- *Type:* aws-cdk-lib.aws_sns.ITopic
- *Default:* no notification
SNS topic for vulnerabilities notification.
If specified, an SNS topic notification will be sent when vulnerabilities or EOL (End of Life) OS are detected.
The notification is sent regardless of the `failOnVulnerability` setting.
This means you can choose to receive notifications even when you don't want the deployment to fail.
You can specify an SNS topic associated with AWS Chatbot, as notifications are sent in AWS Chatbot message format.
---
### S3OutputOptions
Output configuration for scan logs to S3 bucket.
#### Initializer
```typescript
import { S3OutputOptions } from 'image-scanner-with-trivy'
const s3OutputOptions: S3OutputOptions = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| type | ScanLogsOutputType | The type of scan logs output. |
| bucketName | string | The name of the S3 bucket. |
| prefix | string | Optional prefix for S3 objects. |
| sbomFormat | SbomFormat | Optional SBOM format to output in addition to scan logs. |
---
##### `type`Required
```typescript
public readonly type: ScanLogsOutputType;
```
- *Type:* ScanLogsOutputType
The type of scan logs output.
---
##### `bucketName`Required
```typescript
public readonly bucketName: string;
```
- *Type:* string
The name of the S3 bucket.
---
##### `prefix`Optional
```typescript
public readonly prefix: string;
```
- *Type:* string
Optional prefix for S3 objects.
---
##### `sbomFormat`Optional
```typescript
public readonly sbomFormat: SbomFormat;
```
- *Type:* SbomFormat
- *Default:* No SBOM output
Optional SBOM format to output in addition to scan logs.
---
### S3OutputProps
Configuration for scan logs output to S3 bucket.
#### Initializer
```typescript
import { S3OutputProps } from 'image-scanner-with-trivy'
const s3OutputProps: S3OutputProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| bucket | aws-cdk-lib.aws_s3.IBucket | The S3 bucket to output scan logs. |
| prefix | string | Optional prefix for S3 objects. |
| sbomFormat | SbomFormat | Optional SBOM format to output in addition to scan logs. When specified, SBOM will be generated and uploaded to S3. |
---
##### `bucket`Required
```typescript
public readonly bucket: IBucket;
```
- *Type:* aws-cdk-lib.aws_s3.IBucket
The S3 bucket to output scan logs.
---
##### `prefix`Optional
```typescript
public readonly prefix: string;
```
- *Type:* string
Optional prefix for S3 objects.
---
##### `sbomFormat`Optional
```typescript
public readonly sbomFormat: SbomFormat;
```
- *Type:* SbomFormat
- *Default:* No SBOM output
Optional SBOM format to output in addition to scan logs. When specified, SBOM will be generated and uploaded to S3.
**Note**: SBOM generation is not a vulnerability scan. When this option is specified:
- Trivy generates a Software Bill of Materials (SBOM) instead of performing a vulnerability scan
- The scan will not fail regardless of the `failOnVulnerability` setting
- SNS notifications (`vulnsNotificationTopic`) will not be sent since no vulnerabilities are detected
- The SBOM file and stderr logs will be uploaded to S3
---
### ScanLogsOutputOptions
Output configurations for scan logs.
#### Initializer
```typescript
import { ScanLogsOutputOptions } from 'image-scanner-with-trivy'
const scanLogsOutputOptions: ScanLogsOutputOptions = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| type | ScanLogsOutputType | The type of scan logs output. |
---
##### `type`Required
```typescript
public readonly type: ScanLogsOutputType;
```
- *Type:* ScanLogsOutputType
The type of scan logs output.
---
## Classes
### ScanLogsOutput
Represents the output of the scan logs.
#### Initializers
```typescript
import { ScanLogsOutput } from 'image-scanner-with-trivy'
new ScanLogsOutput()
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| bind | Returns the output configuration for scan logs. |
---
##### `bind`
```typescript
public bind(grantee: IGrantable): ScanLogsOutputOptions
```
Returns the output configuration for scan logs.
###### `grantee`Required
- *Type:* aws-cdk-lib.aws_iam.IGrantable
---
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| cloudWatchLogs | Scan logs output to CloudWatch Logs log group. |
| s3 | Scan logs output to S3 bucket. |
---
##### `cloudWatchLogs`
```typescript
import { ScanLogsOutput } from 'image-scanner-with-trivy'
ScanLogsOutput.cloudWatchLogs(options: CloudWatchLogsOutputProps)
```
Scan logs output to CloudWatch Logs log group.
**Note on Large Scan Results**: CloudWatch Logs has a limit of 1 MB per log event.
If Trivy scan results exceed this limit, they will be automatically
split into multiple log events. Each chunk will be prefixed with `[part X/Y]` to
indicate the sequence, ensuring no data loss while staying within CloudWatch Logs quotas.
**For large scan results, we recommend using S3 output instead** to avoid fragmentation
and make it easier to view complete results.
###### `options`Required
- *Type:* CloudWatchLogsOutputProps
---
##### `s3`
```typescript
import { ScanLogsOutput } from 'image-scanner-with-trivy'
ScanLogsOutput.s3(options: S3OutputProps)
```
Scan logs output to S3 bucket.
###### `options`Required
- *Type:* S3OutputProps
---
### TargetImagePlatform
Enum for Target Image Platform.
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| custom | Custom value for target image platform. |
---
##### `custom`
```typescript
import { TargetImagePlatform } from 'image-scanner-with-trivy'
TargetImagePlatform.custom(value: string)
```
Custom value for target image platform.
The value should be in the format OS/Architecture for the image, such as `linux/arm64`.
###### `value`Required
- *Type:* string
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| value | string | *No description.* |
---
##### `value`Required
```typescript
public readonly value: string;
```
- *Type:* string
---
#### Constants
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| LINUX_AMD64 | TargetImagePlatform | Linux AMD64 platform. |
| LINUX_ARM64 | TargetImagePlatform | Linux ARM64 platform. |
---
##### `LINUX_AMD64`Required
```typescript
public readonly LINUX_AMD64: TargetImagePlatform;
```
- *Type:* TargetImagePlatform
Linux AMD64 platform.
---
##### `LINUX_ARM64`Required
```typescript
public readonly LINUX_ARM64: TargetImagePlatform;
```
- *Type:* TargetImagePlatform
Linux ARM64 platform.
---
### TrivyIgnore
Union-like class for specifying Trivy ignore configuration.
You can either specify ignore rules inline, or point to an existing ignore file.
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| fromFilePath | Specify the path to an existing trivyignore file. |
| fromRules | Specify ignore rules inline (equivalent to writing lines in a .trivyignore file). |
---
##### `fromFilePath`
```typescript
import { TrivyIgnore } from 'image-scanner-with-trivy'
TrivyIgnore.fromFilePath(path: string, fileType?: TrivyIgnoreFileType)
```
Specify the path to an existing trivyignore file.
> [https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml](https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml)
###### `path`Required
- *Type:* string
Path to the ignore file.
---
###### `fileType`Optional
- *Type:* TrivyIgnoreFileType
File format.
Defaults to `TrivyIgnoreFileType.TRIVYIGNORE`.
---
##### `fromRules`
```typescript
import { TrivyIgnore } from 'image-scanner-with-trivy'
TrivyIgnore.fromRules(rules: string[])
```
Specify ignore rules inline (equivalent to writing lines in a .trivyignore file).
> [https://trivy.dev/docs/latest/configuration/filtering/#trivyignore](https://trivy.dev/docs/latest/configuration/filtering/#trivyignore)
###### `rules`Required
- *Type:* string[]
Each element corresponds to one line in the .trivyignore file.
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| rules | string[] | *No description.* |
| fileType | TrivyIgnoreFileType | *No description.* |
---
##### `rules`Required
```typescript
public readonly rules: string[];
```
- *Type:* string[]
---
##### `fileType`Optional
```typescript
public readonly fileType: TrivyIgnoreFileType;
```
- *Type:* TrivyIgnoreFileType
---
## Enums
### ImageConfigScanners
Enum for ImageConfigScanners.
> [https://aquasecurity.github.io/trivy/latest/docs/target/container_image/#container-image-metadata](https://aquasecurity.github.io/trivy/latest/docs/target/container_image/#container-image-metadata)
#### Members
| **Name** | **Description** |
| --- | --- |
| CONFIG | *No description.* |
| SECRET | *No description.* |
---
##### `CONFIG`
---
##### `SECRET`
---
### SbomFormat
SBOM (Software Bill of Materials) output format for Trivy scans.
#### Members
| **Name** | **Description** |
| --- | --- |
| CYCLONEDX | CycloneDX JSON format. |
| SPDX_JSON | SPDX JSON format. |
| SPDX | SPDX Tag-Value format (human-readable). |
---
##### `CYCLONEDX`
CycloneDX JSON format.
---
##### `SPDX_JSON`
SPDX JSON format.
---
##### `SPDX`
SPDX Tag-Value format (human-readable).
---
### ScanLogsOutputType
Enum for ScanLogsOutputType.
#### Members
| **Name** | **Description** |
| --- | --- |
| CLOUDWATCH_LOGS | Output scan logs to CloudWatch Logs. |
| S3 | Output scan logs to S3 bucket. |
---
##### `CLOUDWATCH_LOGS`
Output scan logs to CloudWatch Logs.
---
##### `S3`
Output scan logs to S3 bucket.
---
### Scanners
Enum for Scanners.
> [https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#enabledisable-scanners](https://aquasecurity.github.io/trivy/latest/docs/configuration/others/#enabledisable-scanners)
#### Members
| **Name** | **Description** |
| --- | --- |
| VULN | *No description.* |
| CONFIG | *No description.* |
| SECRET | *No description.* |
| LICENSE | *No description.* |
---
##### `VULN`
---
##### `CONFIG`
---
##### `SECRET`
---
##### `LICENSE`
---
### Severity
Enum for Severity Selection.
> [https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#severity-selection](https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#severity-selection)
#### Members
| **Name** | **Description** |
| --- | --- |
| UNKNOWN | *No description.* |
| LOW | *No description.* |
| MEDIUM | *No description.* |
| HIGH | *No description.* |
| CRITICAL | *No description.* |
---
##### `UNKNOWN`
---
##### `LOW`
---
##### `MEDIUM`
---
##### `HIGH`
---
##### `CRITICAL`
---
### TrivyIgnoreFileType
File type for TrivyIgnore file path.
#### Members
| **Name** | **Description** |
| --- | --- |
| TRIVYIGNORE | .trivyignore file. |
| TRIVYIGNORE_YAML | .trivyignore.yaml file. |
---
##### `TRIVYIGNORE`
.trivyignore file.
> [https://trivy.dev/docs/latest/configuration/filtering/#trivyignore](https://trivy.dev/docs/latest/configuration/filtering/#trivyignore)
---
##### `TRIVYIGNORE_YAML`
.trivyignore.yaml file.
> [https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml](https://trivy.dev/docs/latest/configuration/filtering/#trivyignoreyaml)
---