> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-iac/getting-started-with-cloud-scans/manage-cloud-environments/scan-a-cloud-environment.md). # Scan a cloud environment How to scan a cloud environment with Snyk Snyk automatically runs a scan when a [cloud environment](/scan-fix-and-prevent/scan-with-snyk/snyk-iac/getting-started-with-cloud-scans/key-concepts-for-cloud-scans.md#environments) is created. After that, Snyk scans the environment once every 24 hours. You can also manually trigger a new scan at any time by using the [Snyk API](https://apidocs.snyk.io/?version=2022-12-21%7Ebeta#post-/orgs/-org_id-/cloud/scans). ## Using `jq` If you have [jq](https://stedolan.github.io/jq/download/) installed, you can execute a single command to retrieve the first environment ID from the [Snyk API Create scan](https://apidocs.snyk.io/#post-/orgs/-org_id-/cloud/scans) endpoint to trigger the scan manually and then manually scan the environment: ``` SNYK_ORG_ID="YOUR-ORGANIZATION-ID" && \ SNYK_API_TOKEN="YOUR-API-TOKEN" && \ SNYK_ENV_ID=$(curl -s -X GET \ "https://api.snyk.io/rest/orgs/${SNYK_ORG_ID}/cloud/environments?version=2022-12-21~beta&kind=aws,azure,google" \ -H "Authorization: token ${SNYK_API_TOKEN}" | jq -r '.data[0].id') && \ curl -X POST \ "https://api.snyk.io/rest/orgs/${SNYK_ORG_ID}/cloud/scans?version=2022-12-21~beta" \ -H "Authorization: token ${SNYK_API_TOKEN}" \ -H "Content-Type:application/vnd.api+json" -d "{ \"data\": { \"relationships\": { \"environment\": { \"data\": { \"id\": \"${SNYK_ENV_ID}\", \"type\": \"environment\" } } }, \"type\": \"resource\" } }" ``` Because `jq -r '.data[0].id` returns the ID of the first environment shown in the Snyk API [List environments](https://apidocs.snyk.io/#get-/orgs/-org_id-/cloud/environments) output, this technique is especially useful if your Organization has a single environment. You can also change the `0` to another number to scan a different environment; for example, `jq -r '.data[1].id` will return the ID of the second environment in the output. ## Without `jq` If you so not have [jq](https://stedolan.github.io/jq/download/) installed, you can send a request to the Snyk API to return all your environment IDs, look for the ID of the environment you want to scan, and send another request to manually trigger the scan. ### Find the environment ID First, find the ID of the Cloud environment you want to scan. Send a request to the [`/cloud/environments`](https://apidocs.snyk.io/#get-/orgs/-org_id-/cloud/environments) endpoint in the following format: ``` curl -X GET \ 'https://api.snyk.io/rest/orgs/YOUR-ORGANIZATION-ID/cloud/environments?version=2022-12-21~beta' \ -H 'Authorization: token YOUR-API-TOKEN' ``` In the output, look for the `data.id` property. In the shortened example that follows, the ID is `3b7ccff9-8900-4e54-0000-1234abcd1234`: ```json { "jsonapi": { "version": "1.0" }, "data": { "id": "3b7ccff9-8900-4e54-0000-1234abcd1234", } } ``` ### Trigger the scan To manually trigger a scan, send a request to the [`/cloud/scans`](https://apidocs.snyk.io/#post-/orgs/-org_id-/cloud/scans) endpoint in the following format: ``` curl -X POST \ 'https://api.snyk.io/rest/orgs/YOUR-ORGANIZATION-ID/cloud/scans?version=2022-12-21~beta' \ -H 'Authorization: token YOUR-API-TOKEN' \ -H "Content-Type:application/vnd.api+json" -d '{ "data": { "relationships": { "environment": { "data": { "id": "YOUR-ENVIRONMENT-ID", "type": "environment" } } }, "type": "resource" } }' ``` Note: This example uses [curl](https://curl.se/), but you can use any API client, such as [Postman](https://www.postman.com/) or [HTTPie](https://httpie.io/). ## Understand the API response Snyk returns a JSON document containing details about the new scan, for example: ```json { "jsonapi": { "version": "1.0" }, "data": { "id": "a7fa2167-58a8-4ac5-9999-0987dcba6543", "type": "scan", "attributes": { "created": "2022-08-07T04:59:58.639423469Z", "updated": null, "finished": null, "revision": 2, "kind": "user_initiated", "status": "queued" }, "relationships": { "environment": { "data": { "id": "3b7ccff9-8900-4e54-0000-1234abcd1234", "type": "environment" }, "links": { "related": "/orgs/d70c1768-5675-0000-1234-abcd1234abcd/cloud/environments?id=3b7ccff9-8900-4e54-0000-1234abcd1234&version=2022-12-21~beta" } }, "organization": { "data": { "id": "d70c1768-5675-0000-1234-abcd1234abcd", "type": "organization" }, "links": { "related": "/orgs/d70c1768-5675-0000-1234-abcd1234abcd?version=2022-12-21~beta" } } } } } ``` The following are some key attributes from the API response: * `data.id`: Scan ID * `data.attributes.status`: Scan status ## Check scan status To check the status of a scan, retrieve the details of the environment being scanned. Send a request to the [`/cloud/environments`](https://apidocs.snyk.io/#get-/orgs/-org_id-/cloud/environments) endpoint in the following format: ``` curl -X GET \ 'https://api.snyk.io/rest/orgs/YOUR-ORGANIZATION-ID/cloud/environments?id=YOUR-ENVIRONMENT-ID&version=2022-12-21~beta' \ -H 'Authorization: token YOUR-API-TOKEN' ``` Snyk returns a JSON document containing environment details. Look for the `data.attributes.status` value to find the scan status. In the shortened example that follows, the status is `success`: ```json { "jsonapi": { "version": "1.0" }, "data": [ { "id": "3b7ccff9-8900-4e54-0000-1234abcd1234", "type": "environment", "attributes": { "status": "success", } } ] } ``` Scan status values are as follows: * `queued`: Scan is about to start * `in_progress`: Scan is in progress * `success`: Scan is completed * `error`: Scan errored; wait a moment and try scanning again ## View all scans for an Organization To view all scans for an Organization, send an API request to the [List scans](https://apidocs.snyk.io/#get-/orgs/-org_id-/cloud/scans) endpoint in the following format: ``` curl -X GET \ 'https://api.snyk.io/rest/orgs/YOUR-ORGANIZATION-ID/cloud/scans?version=2022-12-21~beta' \ -H 'Authorization: token YOUR-API-TOKEN' ``` Snyk returns a JSON document containing details about all scans, for example: ```json { "jsonapi": { "version": "1.0" }, "data": [ { "id": "a7fa2167-58a8-4ac5-9999-0987dcba6543", "type": "scan", "attributes": { "created_at": "2022-08-04T22:14:47Z", "error": "", "finished_at": "2022-08-04T22:16:31Z", "kind": "user_initiated", "options": { "role_arn": "arn:aws:iam::123456789012:role/snyk-cloud-role" }, "revision": 2, "status": "success", "updated_at": "2022-08-04T22:16:31Z" }, "relationships": { "environment": { "data": { "id": "3b7ccff9-8900-4e54-0000-1234abcd1234", "type": "environment" }, "links": { "related": "/orgs/d70c1768-5675-0000-1234-abcd1234abcd/cloud/environments?id=3b7ccff9-8900-4e54-0000-1234abcd1234&version=2022-12-21~beta" } }, "organization": { "data": { "id": "d70c1768-5675-0000-1234-abcd1234abcd", "type": "organization" }, "links": { "related": "/orgs/d70c1768-5675-0000-1234-abcd1234abcd?version=2022-12-21~beta" } } } } ] } ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-iac/getting-started-with-cloud-scans/manage-cloud-environments/scan-a-cloud-environment.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.