# ImageScanningConfigurationProperty

Contains settings for Image Builder image resource and container image scans.

- Source: Generated code
- Type last changed: v2.276.0 · 10 Nov 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_imagebuilder as imagebuilder } from 'aws-cdk-lib';
const imageScanningConfigurationProperty: imagebuilder.CfnImage.ImageScanningConfigurationProperty = {
  ecrConfiguration: {
    containerTags: ['containerTags'],
    repositoryName: 'repositoryName',
  },
  imageScanningEnabled: false,
  imageScanningTypes: ['imageScanningTypes'],
  scanResultCondition: {
    maximumSeverityLabel: 'maximumSeverityLabel',

    // the properties below are optional
    fixAvailable: false,
  },
};
```

## Properties

- `ecrConfiguration`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnImage.EcrConfigurationProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_imagebuilder.CfnImage.EcrConfigurationProperty.html) — Contains Amazon ECR settings for vulnerability scans.

- `imageScanningEnabled`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — A setting that indicates whether Image Builder keeps a snapshot of the vulnerability scans that Amazon Inspector runs against the build instance when you create a new image.

- `imageScanningTypes`: string[] — The type of vulnerability scan that Image Builder runs for AMI output when ImageScanningEnabled is true.

  Specify a single value. If you omit ImageScanningTypes, Image Builder uses TEST_INSTANCE_CVE. With TEST_INSTANCE_CVE, Amazon Inspector scans the test instance during image tests, and you must activate Amazon Inspector for Amazon EC2 scanning in your account. With ON_DEMAND_AMI_CVE, Amazon Inspector starts an on-demand scan of the output AMI during image tests. You must build from an image recipe, but you do not need to activate Amazon Inspector in your account.

- `scanResultCondition`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnImage.ScanResultConditionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_imagebuilder.CfnImage.ScanResultConditionProperty.html) — The condition that the output AMI's scan results must meet for the image to pass.

  When you set it, the test phase waits for the scan to finish, and Image Builder fails the image if a counted finding exceeds MaximumSeverityLabel.