ankos scan

ankos scan is the primary command. It runs the registered evidence collectors against your cloud account using your local credentials, writes the results into an output directory, and computes a SHA-256 manifest so the evidence can be independently verified.

Synopsis

ankos scan [flags]

Quick start

# Scan AWS with default settings (us-east-1, all AWS collectors)
ankos scan

# Scan a specific GCP project
ankos scan --provider gcp --gcp-project my-project-id

# Scan only specific collectors
ankos scan --collectors iam,vpc,s3,kms

# Scan all enabled AWS regions
ankos scan --all-regions

# Validate without making API calls
ankos scan --dry-run

Flags

Collector selection

AWS-specific

GCP-specific

Output

Upload to Ankos cloud

Multi-account (AWS)

Multi-account scanning uses STS AssumeRole against each account's configured role ARN. See ankos accounts --help for setup.

Validation + exit codes

Examples

Single-region AWS scan, default collectors

ankos scan

Output: ankos-evidence-20260526-153045/ containing one JSON file per collector, an aggregate evidence.json, and a manifest.json.

Multi-region scan

ankos scan --region us-east-1,eu-west-1 --collectors iam,cloudtrail,kms

Each collector runs in each region. The output filenames include the region for disambiguation (e.g. iam-us-east-1.json).

GCP scan with a subset of collectors

ankos scan --provider gcp \
           --gcp-project acme-prod \
           --collectors gcp-iam,gcp-kms,gcp-gcs

Scan + upload in one command

ankos auth set-key --key <your-api-key>    # one-time setup
ankos scan --upload

The scan runs locally first, then the evidence is uploaded to your Ankos ledger and attached to the matching entries in your active cycle.

Seed the ledger in the same step (Team)

ankos scan --upload --seed-ledger

On the Team plan, add --seed-ledger to also push the remediation plan onto the matching ledger entries as checklist items — no separate remediate --seed-ledger run. The plan is built locally, so it respects your .ankosscope and .ankosignore, and it seeds every actionable finding (use remediate --severity … --seed-ledger if you want to seed only a subset).

Prefer it always on? Flip it once and plain scan --upload will do it:

ankos config seed-on-upload on

Seeding never blocks the upload — your evidence is already safe; if seeding fails (e.g. you're not on the Team plan) you'll see a warning, not an error.

Upload an existing scan without re-running

ankos scan --upload -o ./ankos-evidence-20260526-153045/

If -o points to a directory that already contains a manifest.json, the CLI skips the scan and uploads what's already there.

CI-friendly mode

ankos scan --format json --fail-on any --output ./out

--format json emits structured progress to stdout so other tools can parse it. --fail-on any makes the command exit non-zero if anything failed — useful for build pipelines.

Output

Every scan produces a directory like this:

ankos-evidence-20260526-153045/
├── manifest.json              # SHA-256 hashes + scan metadata
├── evidence.json              # Full package as a single JSON document
├── iam.json                   # Per-collector evidence (one per collector)
├── vpc.json
├── kms.json
├── ... (one per successful collector)

See Scan output for the JSON shapes.

Authentication

The CLI uses your existing local credentials — the same ones the AWS CLI or gcloud reads. It does not prompt for or store credentials.

• AWS: standard provider chain (env vars → ~/.aws/credentials → IAM role on EC2/ECS/Lambda → SSO). Use --profile to pin to a named profile.
• GCP: Application Default Credentials (ADC). Run gcloud auth application-default login or set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON path. The CLI uses read-only scopes where the service offers them.

Permissions required

All collectors are read-only. For AWS, the broadest scope is SecurityAudit plus ViewOnlyAccess. For GCP, project-level Viewer plus the relevant service-specific viewer roles is sufficient.

If a collector hits a permission error on a specific call, it reports the failure and continues — other collectors still produce evidence. Use --dry-run ahead of time to validate which collectors are wired up.

Exit codes