Least Privilege IAM for Trivy: Secure ECR and EKS Scanning in AWS

As organizations increasingly adopt containers and Kubernetes in the cloud, security teams require efficient ways to assess workloads without introducing excessive privileges. One of the most common mistakes during cloud security assessments is granting overly permissive access such as full administrative rights for simple read-only scanning activities.

Fortunately, Trivy provides a lightweight and security-focused approach for scanning container images and Kubernetes environments while operating with minimal privileges.

This article explains the minimum AWS permissions required for Trivy when scanning:

• Amazon ECR
• Amazon EKS

using a secure read-only access model.

Why Least Privilege Matters

Security tools themselves can become high-value attack targets if granted excessive permissions.

Using:

• AdministratorAccess
• wildcard IAM permissions
• cluster-admin Kubernetes roles

for vulnerability scanning introduces unnecessary risk.

Following the principle of least privilege helps:

• Reduce blast radius
• Limit accidental modifications
• Improve compliance posture
• Minimize credential abuse risk
• Support secure DevSecOps practices

For Trivy, read-only access is usually sufficient.

What Trivy Needs to Access

When operating in AWS environments, Trivy commonly performs two major activities:

ComponentPurposeECRPull and scan container imagesEKSInspect Kubernetes resources and configurations

Importantly, Trivy does not normally require:

• resource creation
• workload deployment
• configuration changes
• administrative actions

This makes it ideal for restricted read-only security assessments.

Scanning Amazon ECR Images

Trivy can scan images directly from Amazon ECR repositories.

Example:

trivy image <account-id>.dkr.ecr.ap-southeast-1.amazonaws.com/backend:latest

To do this, Trivy needs permission to:

• authenticate to ECR
• retrieve image metadata
• download image layers

Minimal ECR IAM Permissions

The following IAM policy is sufficient for most Trivy ECR image scans:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Resource": "*"
    }
  ]
}

Scanning Amazon EKS Clusters

Trivy can also scan Kubernetes resources inside Amazon EKS clusters.

Example:

trivy k8s cluster

This enables:

• RBAC analysis
• workload inspection
• CIS benchmark checks
• Kubernetes misconfiguration scanning

Minimal AWS IAM Permissions for EKS

At the AWS layer, Trivy only requires basic cluster discovery permissions:

{
  "Effect": "Allow",
  "Action": [
    "eks:DescribeCluster",
    "eks:ListClusters"
  ],
  "Resource": "*"
}

Why These Permissions Are Needed

PermissionPurposeeks:ListClustersEnumerate EKS clusterseks:DescribeClusterRetrieve cluster connection details

These permissions allow Trivy to:

• identify clusters
• retrieve API endpoints
• obtain cluster metadata

without modifying any AWS resources.

Kubernetes RBAC Permissions Inside EKS

AWS IAM permissions alone are not enough.

Because EKS is Kubernetes-based, Trivy also requires Kubernetes RBAC permissions inside the cluster itself.

The recommended approach is to create a read-only ClusterRole.

Minimal Kubernetes RBAC for Trivy

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: trivy-read-only

rules:

- apiGroups: [""]
  resources:
    - pods
    - services
    - configmaps
    - namespaces
    - nodes
  verbs:
    - get
    - list
    - watch

- apiGroups: ["apps"]
  resources:
    - deployments
    - daemonsets
    - statefulsets
    - replicasets
  verbs:
    - get
    - list
    - watch

- apiGroups: ["rbac.authorization.k8s.io"]
  resources:
    - roles
    - rolebindings
    - clusterroles
    - clusterrolebindings
  verbs:
    - get
    - list
    - watch

- apiGroups: ["networking.k8s.io"]
  resources:
    - networkpolicies
    - ingresses
  verbs:
    - get
    - list
    - watch

Why Read-Only RBAC Is Enough

Trivy primarily performs:

• resource enumeration
• manifest inspection
• configuration analysis
• vulnerability correlation

It does not require:

• create
• update
• patch
• delete
• exec

permissions for normal scanning operations.

This significantly reduces operational and security risk.

Full Combined IAM Policy for Trivy

The following policy combines minimal ECR and EKS access:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ECRReadOnly",
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EKSReadOnly",
      "Effect": "Allow",
      "Action": [
        "eks:DescribeCluster",
        "eks:ListClusters"
      ],
      "Resource": "*"
    }
  ]
}

Security Best Practices

When deploying Trivy in AWS environments:

Recommended

• Use dedicated IAM roles
• Apply least privilege
• Use temporary credentials
• Rotate credentials regularly
• Monitor access using AWS CloudTrail
• Use read-only Kubernetes RBAC

Avoid

• AdministratorAccess
• cluster-admin roles
• wildcard *:* IAM permissions
• long-lived credentials

Conclusion

Trivy provides a highly effective method for scanning AWS container and Kubernetes environments without requiring excessive privileges. By combining:

• minimal ECR read-only access
• minimal EKS discovery permissions
• Kubernetes read-only RBAC

organizations can securely perform:

• vulnerability scanning
• Kubernetes security reviews
• CIS benchmark checks
• RBAC assessments
• configuration analysis

while maintaining strong least-privilege security controls.

For most deployments, simple read-only access is not only sufficient — it is the recommended security model.

Reference: https://engsooncheah.medium.com/securing-red-hat-openshift-with-trivy-a-practical-security-assessment-guide-84e0672abcba

Trivy #AWS #ECR #EKS