With this option, a single Agentless scanner is deployed in a single region. Datadog recommends this option. However, this option can incur higher costs, as it requires each Agentless scanner to perform cross-region scans per account.
To deploy in a single region, see the example.
With this option, Agentless scanners are deployed on a single cloud account and are distributed across multiple regions within the account. With this deployment model, Agentless scanners are granted visibility without needing to perform cross-region scans, which are expensive in practice.
To deploy in multiple regions, see the example.
With this option, an Agentless scanner is deployed in a single or multi-region set-up on a single account. You don't need to deploy the scanner in any of your other accounts. Instead, a single delegate role is created that allows the scanner access to that account.
To scan across accounts, see the example
If you want to avoid creating a new VPC for the Agentless scanners, and you want to reuse one of your own, see the example