AWS inspector documentation change
Summary
Updated IAM policy documentation with new permissions for Amazon Inspector service role, including network configuration scanning, CloudTrail monitoring, Lambda scanning, and expanded resource scoping
Security assessment
The changes document expanded IAM permissions required for security scanning capabilities (CIS scans, Lambda code analysis, network config inspection). While these enable security features, there's no evidence of addressing a specific vulnerability or incident. The updates inform users about required permissions for Inspector's security assessments.
Diff
diff --git a/inspector/latest/user/security-iam-awsmanpol.md b/inspector/latest/user/security-iam-awsmanpol.md index dc00b6342..6598eb9fe 100644 --- a//inspector/latest/user/security-iam-awsmanpol.md +++ b//inspector/latest/user/security-iam-awsmanpol.md @@ -176,2 +176,3 @@ Change | Description | Date -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added new permissions that allow read-only access to Amazon ECS and Amazon EKS actions. | March 25, 2025 -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to return function tags in AWS Lambda. | July 31, 2024 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added a new permission that allows Amazon Inspector to describe IP addresses and internet gateways. | April 29, 2025 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added new permissions that allow read-only access to Amazon ECS and Amazon EKS actions. | March 25, 2025 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to return function tags in AWS Lambda. | July 31, 2024 @@ -180 +181 @@ AmazonInspector2ManagedCisPolicy – New policy | Amazon Inspector has added a -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to start CIS scans on target instances. | January 23, 2024 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to start CIS scans on target instances. | January 23, 2024 @@ -183 +184 @@ AmazonInspector2ReadOnlyAccess – Updates to an existing policy | Amazon Inspe -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to scan network configurations of Amazon EC2 instances that are part of Elastic Load Balancing target groups. | August 31, 2023 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to scan network configurations of Amazon EC2 instances that are part of Elastic Load Balancing target groups. | August 31, 2023 @@ -188 +189 @@ AmazonInspector2ReadOnlyAccess – Updates to an existing policy | Amazon Inspe -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to create AWS CloudTrail service-linked channels in your account when you activate Lambda scanning. This allows Amazon Inspector to monitor CloudTrail events in your account. | April 30, 2023 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to create AWS CloudTrail service-linked channels in your account when you activate Lambda scanning. This allows Amazon Inspector to monitor CloudTrail events in your account. | April 30, 2023 @@ -190,8 +191,8 @@ AmazonInspector2FullAccess – Updates to an existing policy | Amazon Inspector -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to send information to Amazon EC2 Systems Manager about the custom paths a customer has defined for Amazon EC2 deep inspection. | April 17, 2023 -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to create AWS CloudTrail service-linked channels in your account when you activate Lambda scanning. This allows Amazon Inspector to monitor CloudTrail events in your account. | April 30, 2023 -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to request scans of the developer code in AWS Lambda functions, and receive scan data from Amazon CodeGuru Security. Additionally, Amazon Inspector has added permissions to review IAM policies. Amazon Inspector uses this information to scan Lambda functions for code vulnerabilities. | February 28, 2023 -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added a new statement that allows Amazon Inspector to retrieve information from CloudWatch about when an AWS Lambda function was last invoked. Amazon Inspector uses this information to focus scans on the Lambda functions in your environment that have been active in the last 90 days. | February 20, 2023 -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added a new statement that allows Amazon Inspector to retrieve information about AWS Lambda functions, including each layer version that is associated with each function. Amazon Inspector uses this information to scan Lambda functions for security vulnerabilities. | November 28, 2022 -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has added a new action to allow Amazon Inspector to describe SSM association executions. Additionally, Amazon Inspector has added additional resource scoping to allow Amazon Inspector to create, update, delete, and start SSM associations with `AmazonInspector2` owned SSM documents. | August 31, 2022 -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) Updates to an existing policy | Amazon Inspector has updated the resource scoping of the policy to allow Amazon Inspector to collect software inventory in other AWS partitions. | August 12, 2022 -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – Updates to an existing policy | Amazon Inspector has restructured the resource scoping of the actions allowing Amazon Inspector to create, delete, and update SSM associations. | August 10, 2022 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to send information to Amazon EC2 Systems Manager about the custom paths a customer has defined for Amazon EC2 deep inspection. | April 17, 2023 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to create AWS CloudTrail service-linked channels in your account when you activate Lambda scanning. This allows Amazon Inspector to monitor CloudTrail events in your account. | April 30, 2023 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added new permissions that allow Amazon Inspector to request scans of the developer code in AWS Lambda functions, and receive scan data from Amazon CodeGuru Security. Additionally, Amazon Inspector has added permissions to review IAM policies. Amazon Inspector uses this information to scan Lambda functions for code vulnerabilities. | February 28, 2023 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added a new statement that allows Amazon Inspector to retrieve information from CloudWatch about when an AWS Lambda function was last invoked. Amazon Inspector uses this information to focus scans on the Lambda functions in your environment that have been active in the last 90 days. | February 20, 2023 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added a new statement that allows Amazon Inspector to retrieve information about AWS Lambda functions, including each layer version that is associated with each function. Amazon Inspector uses this information to scan Lambda functions for security vulnerabilities. | November 28, 2022 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has added a new action to allow Amazon Inspector to describe SSM association executions. Additionally, Amazon Inspector has added additional resource scoping to allow Amazon Inspector to create, update, delete, and start SSM associations with `AmazonInspector2` owned SSM documents. | August 31, 2022 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) Updates to an existing policy | Amazon Inspector has updated the resource scoping of the policy to allow Amazon Inspector to collect software inventory in other AWS partitions. | August 12, 2022 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – Updates to an existing policy | Amazon Inspector has restructured the resource scoping of the actions allowing Amazon Inspector to create, delete, and update SSM associations. | August 10, 2022 @@ -200 +201 @@ AmazonInspector2FullAccess – New policy | Amazon Inspector added a new policy -[AmazonInspector2ServiceRolePolicy](./using-service-linked-roles.html) – New policy | Amazon Inspector added a new policy to allow Amazon Inspector to perform actions in other services on your behalf. | November 29, 2021 +[AmazonInspector2ServiceRolePolicy](https://docs.aws.amazon.com/inspector/latest/user/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonInspector2ServiceRolePolicy) – New policy | Amazon Inspector added a new policy to allow Amazon Inspector to perform actions in other services on your behalf. | November 29, 2021