AWS inspector: Document Amazon Inspector machine image (AMI) scanning
Summary
Adds a section describing machine image scanning of Amazon EBS snapshots backing AMIs, including guidance to review scan configuration, and adds `MACHINE_IMAGE` to the `resourceTypes` list for the Enable API operation.
Security assessment
Documents a new vulnerability-scanning resource type (AMI scanning against security advisories) plus configuration scoping guidance; it expands security feature documentation rather than fixing a specific vulnerability.
Evidence
+Run the [Enable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Enable.html) API operation. In the request, provide the account IDs you are activating scans for, and idempotency token, and one or more of `EC2`, `MACHINE_IMAGE`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` for `resourceTypes` to activate scans of that type.
Diff
diff --git a/inspector/latest/user/activate-scans.md b/inspector/latest/user/activate-scans.md index ae8bda2..d6e563c 100644 --- a//inspector/latest/user/activate-scans.md +++ b//inspector/latest/user/activate-scans.md @@ -16,0 +17,8 @@ This scan type extracts metadata from an Amazon EC2 instance before comparing th +###### [Machine image scanning](https://docs.aws.amazon.com/inspector/latest/user/scanning-machine-images.html) + +This scan type extracts a software inventory from the Amazon EBS snapshots that back a machine image (AMI) before comparing that inventory against rules collected from security advisories. When you activate this scan type, Amazon Inspector scans all eligible machine images that your account owns for package vulnerabilities and continues to monitor them. After you activate this scan type, you can view how many machine images are being scanned in the **Machine images** tab. + +###### Note + +After you activate machine image scanning, review your scan configuration to control which machine images are in scope. For more information, see [Configuring machine image scanning](./machine-image-scan-configuration.html). + @@ -66 +74 @@ API -Run the [Enable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Enable.html) API operation. In the request, provide the account IDs you are activating scans for, and idempotency token, and one or more of `EC2`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` for `resourceTypes` to activate scans of that type. +Run the [Enable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Enable.html) API operation. In the request, provide the account IDs you are activating scans for, and idempotency token, and one or more of `EC2`, `MACHINE_IMAGE`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` for `resourceTypes` to activate scans of that type.