> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/aws-ecr-scanner-reference.md).

# AWS ECR step configuration

You can scan your container images and extract scan results from [Amazon Elastic Container Registry (ECR)](https://docs.aws.amazon.com/AmazonECR/latest/userguide/what-is-ecr.html).

### Important notes for running AWS ECR scans in STO <a href="#important-notes-for-running-aws-ecr-scans-in-sto" id="important-notes-for-running-aws-ecr-scans-in-sto"></a>

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).

### AWS ECR step settings for STO scans <a href="#aws-ecr-step-settings-for-sto-scans" id="aws-ecr-step-settings-for-sto-scans"></a>

The recommended workflow is to add an AWS ECR step to a Security or Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and Variant Detection**

**Name**

**Variant**

#### Container image <a href="#container-image" id="container-image"></a>

**Type (*****orchestration*****)**

**Domain (*****extraction*****)**

**Name**

**Tag/Digest**

**Region**

#### Authentication <a href="#authentication" id="authentication"></a>

**Access ID (*****orchestration*****)**

**Access Token**

**Session Token**

To enable session-based authentication with AWS, for example, you can pass AWS session token using the key `CONTAINER_SESSION_TOKEN` with a [Harness text secret](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md) of your token.

**Access Region**

The AWS region of the image to scan.

#### Log Level <a href="#log-level" id="log-level"></a>

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>