Trivy: authentication problem with AWS ECR

[gstolz]

Description

I would like to scan Docker images stored in AWS ECR. The registry requires authentication.
docker login && docker pull works. Scanning image locally works without a problem. But for automation purposes I don't have DinD and I would like to avoid extra pulling.
Therefore I followed the instruction to use AWS ECR remote repo. As described in AWS SDK envvars, I setup the following vars:
export AWS_ACCESS_KEY_ID=<KEY> export AWS_SECRET_ACCESS_KEY=<SECRET> export AWS_DEFAULT_REGION=eu-central-1
Now I run trivy:
trivy --debug repo <TENANT_ID>.dkr.ecr.eu-central-1.amazonaws.com/image:latest

What did you expect to happen?
I would expect that trivy runs the same scans as locally, plus the authentication to AWS ECR registry.

What happened instead?
Doesn't even start, just telling that it is unable to initialize.

Output of run with -debug:

FATAL unable to initialize a scanner: unable to initialize a filesystem scanner: authentication required

Output of trivy -v:

Version: 0.12.0
Vulnerability DB:
  Type: Light
  Version: 1
  UpdatedAt: 2020-10-14 00:38:54.883136731 +0000 UTC
  NextUpdate: 2020-10-14 12:38:54.883136231 +0000 UTC

Additional details (base image name, container registry info...):
Trivy runs as local installation.

[knqyf263]

repo is not for a container registry. Could you try trivy image?

[gstolz]

Thank you very much for the clarification! I don't know why I mixed that up...