# [ECR] [request]: Support ARM64 image scanning in ECR

# [ECR] [request]: Support ARM64 image scanning in ECR

## Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request.

## Problem Statement

ECR image scanning currently has limited support for ARM64 architecture images. When attempting to scan ARM64 images, the scan fails or returns null results, making it impossible to perform security vulnerability assessments on ARM64-based container images.

### Current Behavior

1. **ARM64 images are not scanned**: Images with ARM64 architecture show `scanStatus: null` and `scanFindings: null`
2. **No error message**: The scan simply fails silently without providing clear feedback
3. **Manual scan disabled**: AWS CLI `start-image-scan` command returns "This feature is disabled" for ARM64 images

### Expected Behavior

1. **Full ARM64 scan support**: ARM64 images should be scanned for vulnerabilities just like x86_64 images
2. **Clear error messages**: If scanning is not supported, provide clear error messages explaining the limitation
3. **Documentation**: Clear documentation about ARM64 scanning support and limitations

## Use Case

Organizations use ARM64-based container images for various reasons:
- **Cost optimization**: ARM64 instances are often more cost-effective
- **Performance**: ARM64 can provide better performance for certain workloads
- **Compliance**: Some applications require ARM64 architecture

Without ARM64 scanning support, organizations cannot:
- Perform security assessments on their ARM64 images
- Meet compliance requirements for vulnerability scanning
- Integrate ARM64 images into their security scanning pipeline

## Technical Details

### Image Information
```bash
# Example ARM64 image that cannot be scanned
Architecture: arm64
OS: linux
Scan Status: null
Scan Findings: null
```

### Error Messages
```bash
# AWS CLI error when attempting manual scan
aws ecr start-image-scan --repository-name --image-id imageTag=
# Error: This feature is disabled
```

### Related Issues
- [ECR Console multi-arch support](https://github.com/aws/containers-roadmap/issues/1596)
- [Display image OS and architecture in ECR Console](https://github.com/aws/containers-roadmap/issues/1591)

## Proposed Solution

1. **Extend ECR scanning to support ARM64**: Implement ARM64 scanning capabilities in ECR
2. **Update documentation**: Clearly document ARM64 scanning support and limitations
3. **Provide fallback options**: If full scanning is not possible, provide alternative scanning methods
4. **Error handling**: Improve error messages to clearly indicate when scanning is not supported

## Alternative Solutions

If full ARM64 scanning support is not immediately feasible, consider:
1. **Partial scanning**: Support basic vulnerability scanning for ARM64 images
2. **External integration**: Allow integration with external ARM64-compatible scanning tools
3. **Multi-architecture support**: Support scanning of multi-architecture images that include both x86_64 and ARM64

## Impact

This limitation affects:
- **Security**: Inability to scan ARM64 images for vulnerabilities
- **Compliance**: Cannot meet security scanning requirements for ARM64 workloads
- **Cost**: May force organizations to use x86_64 images even when ARM64 would be more cost-effective
- **Performance**: May prevent adoption of ARM64 for performance-critical workloads

## Additional Information

- **Scan Type**: Enhanced scanning
- **Scan Frequency**: SCAN_ON_PUSH
- **Architecture**: ARM64
- **OS**: Linux

Thank you for considering this request!

The issue names AWS ECR enhanced scanning, SCAN_ON_PUSH, and the aws ecr start-image-scan command; start by reproducing the command against an ARM64 Linux image and checking the documented scanStatus and scanFindings behavior. Done means ARM64 images scan successfully, unsupported cases return a clear error, and the ARM64 limitations are documented.

Written by the indexing model from the issue text.