AWS inspector: Expanded OS support for deep inspection with Enhanced EC2 Scanning
Summary
Added support for Windows/macOS deep inspection via Enhanced EC2 Scanning (VM Scanner) and clarified custom path handling across OSes. Documented default scan locations for Windows.
Security assessment
Expands security documentation by detailing improved vulnerability scanning coverage across operating systems when using modern scanning methods
Evidence
+Deep inspection is not supported for Windows or Mac instances unless you use Enhanced EC2 Scanning. With Enhanced EC2 Scanning, deep inspection is performed by the [Amazon Inspector VM Scanner](https://docs.aws.amazon.com/inspector/latest/user/inspector-vm-scanner.html), which supports Linux, Windows, and macOS instances.
Diff
diff --git a/inspector/latest/user/deep-inspection.md b/inspector/latest/user/deep-inspection.md index f8d455464..fef3eb44b 100644 --- a//inspector/latest/user/deep-inspection.md +++ b//inspector/latest/user/deep-inspection.md @@ -23 +23 @@ To perform deep inspection scans for your Linux-based Amazon EC2 instances, Amaz -###### Note +###### Deep inspection on Windows and macOS @@ -25 +25 @@ To perform deep inspection scans for your Linux-based Amazon EC2 instances, Amaz -Deep inspection is not supported for Windows or Mac instances. +Deep inspection is not supported for Windows or Mac instances unless you use Enhanced EC2 Scanning. With Enhanced EC2 Scanning, deep inspection is performed by the [Amazon Inspector VM Scanner](https://docs.aws.amazon.com/inspector/latest/user/inspector-vm-scanner.html), which supports Linux, Windows, and macOS instances. @@ -67 +67,5 @@ You can deactivate deep inspection through the [UpdateEc2DeepInspectionConfigura -You can set custom paths for Amazon Inspector to scan during deep inspection of your Linux Amazon EC2 instances. When you set a custom path, Amazon Inspector scans packages in that directory and all of the sub-directories in it. +You can set custom paths for Amazon Inspector to scan during deep inspection of your Amazon EC2 instances. When you set a custom path, Amazon Inspector scans packages in that directory and all of the sub-directories in it, in addition to the locations Amazon Inspector scans by default. + +###### Important + +Custom paths are supported for Linux, Windows, and macOS instances when you use [Enhanced EC2 Scanning](https://docs.aws.amazon.com/inspector/latest/user/inspector-vm-scanner.html) (the Amazon Inspector VM Scanner). If you use the legacy Amazon Inspector SSM plugin instead of Enhanced EC2 Scanning, deep inspection and custom paths are available only for Linux instances. @@ -71 +75 @@ All accounts can define up to 5 custom paths. The delegated administrator for an -Amazon Inspector scans all custom paths in addition to the following default paths, which Amazon Inspector scans for all accounts: +Amazon Inspector scans all custom paths in addition to the locations that Amazon Inspector scans by default for all accounts. On Linux instances, the default locations include the following: @@ -83,0 +88,2 @@ Amazon Inspector scans all custom paths in addition to the following default pat +On Windows instances, Amazon Inspector scans standard operating system and programming language package locations on the system drive by default. Software installed in a custom or non-standard location – for example, a database or application server on a non-system drive such as `D:\` – is scanned only if you add it as a custom path. +