AWS inspector documentation change
Summary
Updated ECR re-scan duration documentation: default scan duration changed from 30 to 14 days, clarified monitoring criteria (last-in-use vs. pull date), added new duration options (30/60/90/180 days), and added a note about settings prior to May 16, 2025, remaining unchanged.
Security assessment
The change adjusts default scan durations and provides more configuration options, which improves security posture by encouraging more frequent scans. However, there is no explicit mention of addressing a specific security vulnerability or incident.
Diff
diff --git a/inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md b/inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md index 75b9ad636..fcecc9f9e 100644 --- a//inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md +++ b//inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md @@ -7 +7 @@ -The Amazon ECR re-scan duration setting determines how long Amazon Inspector continuously monitors container images in repositories. You configure the re-scan duration for the image last in use date, last pull date, and push date. As a best practice, configure the re-scan duration to best suit your environment. +The Amazon ECR re-scan duration setting determines how long Amazon Inspector continuously monitors container images in repositories. You configure the re-scan duration for the image last-in-use date, last pull date, and push date. As a best practice, configure the re-scan duration to best suit your environment. @@ -9 +9 @@ The Amazon ECR re-scan duration setting determines how long Amazon Inspector con -If you build images often, choose a shorter scan duration. For images used over long periods of time, choose a longer scan duration. The default scan duration for new accounts, including new accounts added to an organization, is 30 days. +If you build images often, choose a shorter scan duration. For images used over long periods of time, choose a longer scan duration. The default scan duration for new accounts, including new accounts added to an organization, is 14 days. @@ -11 +11 @@ If you build images often, choose a shorter scan duration. For images used over -Amazon Inspector will continue to monitor and rescan an image as long as it's been pushed or pulled within the configured push and pull dates. The same is true for images within the configured last-in-use date. If an image hasn’t been pushed or pulled within the configured push and pull dates, Amazon Inspector stops monitoring it. The same is also true for images not used within the configured last-in-use date. When Amazon Inspector stops monitoring an image, it sets the image scan status code to `inactive` and reason code to `expired`. Amazon Inspector then schedules all associated image findings to be closed. +Amazon Inspector will continue to monitor and rescan an image as long as it's been last in use on a cluster or pushed within 14 days (by default). If an image hasn’t been pushed or last used on a running container within the configured push and last in use dates, Amazon Inspector stops monitoring it. There is an option to change the setting to monitor images by last pull date instead of the last in use date, if required. When Amazon Inspector stops monitoring an image, it sets the image scan status code to inactive and reason code to expired. Amazon Inspector then schedules all associated image findings to be closed. @@ -18,0 +19,4 @@ When you configure the re-scan duration from a delegated administrator account, +###### Note + +All re-scan duration settings configured prior to May 16, 2025, will remain the unchanged. You can continue using any default settings previously configured. + @@ -21 +25 @@ When you configure the re-scan duration from a delegated administrator account, -The image re-scan duration determines how long Amazon Inspector will monitor images. The image re-scan duration includes two modes: **Last in use date** or **Last pull date**. Choose **Last in use date** if you want to use the last in use date from your Amazon ECS/Amazon EKS cluster activity. Choose **Last pull date** if you want to use the last pull date from you Amazon ECR images to re-scan images. The following options are available as re-scan durations: +The image re-scan duration determines how long Amazon Inspector will monitor images. The image re-scan duration includes two modes: **Last in use date** (default) or **Last pull date**. Choose **Last in use date** (default) if you want to use the last in use date from your Amazon ECS/Amazon EKS cluster activity. Choose **Last pull date** if you want to use the last pull date from your Amazon ECR images to re-scan images. The following options are available as re-scan durations: @@ -24,0 +29,8 @@ The image re-scan duration determines how long Amazon Inspector will monitor ima + * 30 days + + * 60 days + + * 90 days + + * 180 days + @@ -33,0 +46,10 @@ The image push date duration determines how long Amazon Inspector will continuou + * 30 days + + * 60 days + + * 90 days + + * 180 days + + * Lifetime +