AWS inspector documentation change
Summary
Removed section 'About the Amazon Inspector SSM plugin for Windows' including installation paths, data storage locations, and uninstallation instructions.
Security assessment
The removed content focused on operational aspects of the Windows SSM plugin without mentioning security vulnerabilities or security feature enhancements. This appears to be documentation restructuring rather than security-related changes.
Diff
diff --git a/inspector/latest/user/windows-scanning.md b/inspector/latest/user/windows-scanning.md index a7213eac5..aa55e3542 100644 --- a//inspector/latest/user/windows-scanning.md +++ b//inspector/latest/user/windows-scanning.md @@ -5 +5 @@ -Amazon Inspector scan requirements for Windows instancesAbout the Amazon Inspector SSM plugin for WindowsSetting custom schedules for Windows instance scans +Amazon Inspector scan requirements for Windows instancesSetting custom schedules for Windows instance scans @@ -11 +11 @@ Amazon Inspector automatically discovers all supported Windows instances and inc -When Amazon EC2 scanning is activated, Amazon Inspector creates the following SSM associations for your Windows resources: `InspectorDistributor-do-not-delete`, `InspectorInventoryCollection-do-not-delete`, and `InvokeInspectorSsmPlugin-do-not-delete`. To install the Amazon Inspector SSM plugin on your Windows instances, the `InspectorDistributor-do-not-delete` SSM association uses the [`AWS-ConfigureAWSPackage` SSM document](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-ssm-docs.html) and the [`AmazonInspector2-InspectorSsmPlugin` SSM Distributor package](https://docs.aws.amazon.com/systems-manager/latest/userguide/distributor.html). For more information, see About the Amazon Inspector SSM plugin for Windows. To collect instance data and generate Amazon Inspector findings, the `InvokeInspectorSsmPlugin-do-not-delete` SSM association runs the Amazon Inspector SSM plugin at 6-hour intervals. However, you can [customize this setting using a cron or rate expression](https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html). +When Amazon EC2 scanning is activated, Amazon Inspector creates the following SSM associations for your Windows resources: `InspectorDistributor-do-not-delete`, `InspectorInventoryCollection-do-not-delete`, and `InvokeInspectorSsmPlugin-do-not-delete`. To install the Amazon Inspector SSM plugin on your Windows instances, the `InspectorDistributor-do-not-delete` SSM association uses the [`AWS-ConfigureAWSPackage` SSM document](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-ssm-docs.html) and the [`AmazonInspector2-InspectorSsmPlugin` SSM Distributor package](https://docs.aws.amazon.com/systems-manager/latest/userguide/distributor.html). For more information, see [The Amazon Inspector SSM plugin for Windows](https://docs.aws.amazon.com/inspector/latest/user/deep-inspection.html#inspector/latest/user/deep-inspection.html). To collect instance data and generate Amazon Inspector findings, the `InvokeInspectorSsmPlugin-do-not-delete` SSM association runs the Amazon Inspector SSM plugin at 6-hour intervals. However, you can [customize this setting using a cron or rate expression](https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html). @@ -34,31 +33,0 @@ If your host is running in an Amazon VPC without outgoing internet access, Windo -## About the Amazon Inspector SSM plugin for Windows - -The Amazon Inspector SSM plugin is required for Amazon Inspector to scan your Windows instances. The Amazon Inspector SSM plugin is automatically installed on your Windows instances in `C:\Program Files\Amazon\Inspector`, and the executable binary file is named `InspectorSsmPlugin.exe`. - -The following file locations are created to store data the Amazon Inspector SSM plugin collects: - - * `C:\ProgramData\Amazon\Inspector\Input` - - * `C:\ProgramData\Amazon\Inspector\Output` - - * `C:\ProgramData\Amazon\Inspector\Logs` - - - - -By default, the Amazon Inspector SSM plugin runs at below normal priority. - -###### Note - -You can use Windows instances with the [Default Host Management Configuration setting](https://docs.aws.amazon.com/systems-manager/latest/userguide/managed-instances-default-host-management.html). However, you must create or use a role that's configured with the `ssm:PutInventory` and `ssm:GetParameter` permissions. - -### Uninstalling the Amazon Inspector SSM plugin - -If the `InspectorSsmPlugin.exe` file is inadvertently deleted, the `InspectorDistributor-do-not-delete` SSM association will reinstall the plugin at the next Windows scan interval. If you want to uninstall the Amazon Inspector SSM plugin, you can use the **Uninstall** action on the `AmazonInspector2-ConfigureInspectorSsmPlugin` document. - -Additionally, the Amazon Inspector SSM plugin will be automatically uninstalled from all Windows hosts if you deactivate Amazon EC2 scanning. - -###### Note - -If you uninstall the SSM Agent before deactivating Amazon Inspector, the Amazon Inspector SSM plugin will remain on the Windows host but will no longer send data to the Amazon Inspector SSM plugin. For more information, see [Deactivating Amazon Inspector](./deactivating-best-practices.html). -