AWS inspector documentation change
Summary
Updated ECR re-scan duration documentation to add 'last in use date' parameter, reduce default duration from 90 to 30 days, clarify monitoring logic, and reorganize configuration steps. Added note about delegated administrator requirements for ECR scanning visibility.
Security assessment
The changes enhance documentation about monitoring duration configurations but do not address a specific security vulnerability. The added 'last in use date' parameter and reduced default duration (30 days instead of 90) improve security posture by encouraging more frequent scanning of active images, but this is a preventive best practice rather than a response to a disclosed issue. The note about delegated administrators needing ECR scanning enabled to view clusters clarifies operational security requirements but does not indicate a resolved vulnerability.
Diff
diff --git a/inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md b/inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md index 178b99a0a..75b9ad636 100644 --- a//inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md +++ b//inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md @@ -7 +7 @@ -The Amazon ECR re-scan duration setting determines how long Amazon Inspector continuously monitors container images in repositories. You configure the re-scan duration for the image push date and image pull date. As a best practice, configure the re-scan duration to best suit your environment. For example, if you build images often, choose a shorter scan duration. For images used over long periods of time, choose a longer scan duration. The default scan duration for new accounts, including new accounts added to an organization, is 90 days. Amazon Inspector will continue to monitor and rescan an image as long as it's been pushed or pulled within the configured push and pull dates. If the image hasn’t been pushed or pulled within the configured push and pull dates, Amazon Inspector stops monitoring it. When Amazon Inspector stops monitoring an image, it sets the image scan status code to `inactive` and reason code to `expired`. Amazon Inspector then schedules all associated image findings to be closed. If you increase the push date duration, Amazon Inspector applies the change to all actively scanned images in repositories configured for continual scanning. However, inactive images remain inactive, even if you pushed them within the new duration. +The Amazon ECR re-scan duration setting determines how long Amazon Inspector continuously monitors container images in repositories. You configure the re-scan duration for the image last in use date, last pull date, and push date. As a best practice, configure the re-scan duration to best suit your environment. @@ -9,9 +9 @@ The Amazon ECR re-scan duration setting determines how long Amazon Inspector con -###### Note - -When you configure the re-scan duration from a delegated administrator account, Amazon Inspector applies the setting to all member accounts in the organization. - -###### Image push date duration - -The image push date duration determines how long Amazon Inspector continuously monitors images after they were pushed to repositories following the latest pull date. The following options are available as re-scan durations: - - * 14 days +If you build images often, choose a shorter scan duration. For images used over long periods of time, choose a longer scan duration. The default scan duration for new accounts, including new accounts added to an organization, is 30 days. @@ -19 +11 @@ The image push date duration determines how long Amazon Inspector continuously m - * 30 days +Amazon Inspector will continue to monitor and rescan an image as long as it's been pushed or pulled within the configured push and pull dates. The same is true for images within the configured last-in-use date. If an image hasn’t been pushed or pulled within the configured push and pull dates, Amazon Inspector stops monitoring it. The same is also true for images not used within the configured last-in-use date. When Amazon Inspector stops monitoring an image, it sets the image scan status code to `inactive` and reason code to `expired`. Amazon Inspector then schedules all associated image findings to be closed. @@ -21 +13 @@ The image push date duration determines how long Amazon Inspector continuously m - * 60 days +If you increase the push date duration, Amazon Inspector applies the change to all actively scanned images in repositories configured for continual scanning. However, inactive images remain inactive, even if you pushed them within the new duration. @@ -23,5 +15 @@ The image push date duration determines how long Amazon Inspector continuously m - * 90 days (default) - - * 180 days - - * Lifetime +###### Note @@ -28,0 +17 @@ The image push date duration determines how long Amazon Inspector continuously m +When you configure the re-scan duration from a delegated administrator account, Amazon Inspector applies the setting to all member accounts in the organization. If the delegated administrator account does not enable Amazon ECR scanning, it cannot view clusters for an API image. @@ -29,0 +19 @@ The image push date duration determines how long Amazon Inspector continuously m +###### Image re-scan duration @@ -30,0 +21 @@ The image push date duration determines how long Amazon Inspector continuously m +The image re-scan duration determines how long Amazon Inspector will monitor images. The image re-scan duration includes two modes: **Last in use date** or **Last pull date**. Choose **Last in use date** if you want to use the last in use date from your Amazon ECS/Amazon EKS cluster activity. Choose **Last pull date** if you want to use the last pull date from you Amazon ECR images to re-scan images. The following options are available as re-scan durations: @@ -32 +23 @@ The image push date duration determines how long Amazon Inspector continuously m -###### Image pull date duration + * 14 days (default) @@ -34 +24,0 @@ The image push date duration determines how long Amazon Inspector continuously m -The image pull date duration determines how long Amazon Inspector continuously monitors images after the latest pull date. The following options are available as re-scan durations: @@ -36 +25,0 @@ The image pull date duration determines how long Amazon Inspector continuously m - * 14 days @@ -38 +26,0 @@ The image pull date duration determines how long Amazon Inspector continuously m - * 30 days @@ -40 +28 @@ The image pull date duration determines how long Amazon Inspector continuously m - * 60 days +###### Image push date duration @@ -42 +30 @@ The image pull date duration determines how long Amazon Inspector continuously m - * 90 days (default) +The image push date duration determines how long Amazon Inspector will continuously monitor images after being pushed to repositories. The following options are available as re-scan durations: @@ -44 +32 @@ The image pull date duration determines how long Amazon Inspector continuously m - * 180 days + * 14 days (default) @@ -57 +45,3 @@ The image pull date duration determines how long Amazon Inspector continuously m - 4. On **ECR scanning settings** , under **ECR re-scan duration** , choose the image push date duration and image pull date duration that you want to set. + 4. Under **ECR re-scan duration** , choose the image re-scan mode, and then choose the corresponding duration. + + 5. Under **Image push date** , choose the image push date. @@ -59 +49 @@ The image pull date duration determines how long Amazon Inspector continuously m - 5. Choose **Save**. + 6. Choose **Save**.