AWS inspector: Add coverage assessment docs for Amazon Inspector machine image scanning
Summary
Adds a new "Assessing coverage of machine images" section describing the Machine images tab, its All/Scanning/Not scanning groupings, the columns shown (machine image ID, account, OS, status, tags, last scanned), and the possible scanning status values (Actively monitoring, Pending initial scan, Excluded by tag, Scan eligibility expired, Access denied, Unsupported operating system, Collection time limit exceeded, Image size exceeded, Internal error), plus navigation links in the tab list. References CVEs generically as part of describing continuous rescans.
Security assessment
The added content documents visibility into Amazon Inspector vulnerability-scanning coverage for AMIs, including reasons scanning may be skipped (e.g. "Excluded by tag", "Access denied"). It is security-capability documentation but contains no evidence of addressing a specific vulnerability, exploit, or incident, and the only CVE mention is the generic expansion of the acronym for continuous rescans.
Evidence
+## Assessing coverage of machine images
Diff
diff --git a/inspector/latest/user/assessing-coverage.md b/inspector/latest/user/assessing-coverage.md index 293001a..d04ef61 100644 --- a//inspector/latest/user/assessing-coverage.md +++ b//inspector/latest/user/assessing-coverage.md @@ -7 +7 @@ -Assessing account-level coverageAssessing coverage of Amazon EC2 instancesAssessing coverage of Amazon ECR repositoriesAssessing coverage of Amazon ECR container imagesAssessing coverage of AWS Lambda functions +Assessing account-level coverageAssessing coverage of Amazon EC2 instancesAssessing coverage of Amazon ECR repositoriesAssessing coverage of Amazon ECR container imagesAssessing coverage of AWS Lambda functionsAssessing coverage of machine images @@ -30,0 +31,2 @@ The following procedure describes how to assess coverage of your Amazon Inspecto + * Choose **Machine images** to review coverage for the machine images (AMIs) that your accounts own. + @@ -53,0 +56,2 @@ The following topics describe the information each of these tabs provide. + * Assessing coverage of machine images + @@ -266,0 +271,42 @@ For a Lambda function, the possible **Status** values are: +## Assessing coverage of machine images + +The **Machine images** tab shows the machine images (AMIs) that your accounts own. You can group machine images based on the following tabs: + + * **All** – Shows all the machine images that your accounts own. The **Status** column indicates the current scanning status for a machine image. + + * **Scanning** – Shows the machine images that Amazon Inspector is configured to scan. The **Status** column indicates the current scanning status for each machine image. + + * **Not scanning** – Shows the machine images that Amazon Inspector is not configured to scan. The **Reason** column indicates why Amazon Inspector is not monitoring and scanning a machine image. + +A machine image can appear on the **Not scanning** tab for several reasons. Your scan configuration might exclude the image, its operating system or file system might not be supported, or it might fall outside of your scan eligibility windows. For more information, see [Machine image scanning](./scanning-machine-images.html). + + + + +On each tab, the **Machine image** column specifies the ID of the machine image. The **Account** column specifies the AWS account that owns the machine image. **Operating system** specifies the platform of the machine image. The **Status** column indicates the current scanning status for each machine image. **Resource tags** shows the tags that have been applied to the machine image. The **Last scanned** column shows you when Amazon Inspector last checked that machine image for vulnerabilities. For more information, see [Scan behaviors for machine image scanning](./scanning-machine-images.html#machine-image-scan-behavior). + +### Scanning status values for machine images + +For a machine image, the possible **Status** values are: + + * **Actively monitoring** – Amazon Inspector is continuously monitoring and scanning the machine image. Continuous scanning includes an initial scan when you create, copy, register, or enable the machine image, and automated rescans when new Common Vulnerabilities and Exposures (CVEs) are released. + + * **Pending initial scan** – Amazon Inspector has queued the machine image for an initial scan. + + * **Excluded by tag** – Amazon Inspector isn't scanning this machine image because your scan mode or your exclusion options exclude it. In continuous (`SCAN_ALL`) mode, the image carries your configured exclusion tag. Amazon Inspector also reports this reason when the image is a copy of another image or AWS Data Lifecycle Manager created it, and you chose to exclude copied or backup images. For more information, see [Managing machine image scan mode](./machine-image-scan-configuration.html#machine-image-scan-mode) and [Excluding copied and backup machine images](./machine-image-scan-configuration.html#machine-image-exclusions). + + * **Scan eligibility expired** – Amazon Inspector is not monitoring this machine image because it falls outside of both of your scan eligibility windows. For more information, see [Setting scan eligibility windows](./machine-image-scan-configuration.html#machine-image-eligibility-windows). + + * **Access denied** – Amazon Inspector couldn't access the machine image or the snapshots that back it. + + * **Unsupported operating system** – The operating system of the machine image isn't supported for scanning, or one or more of the snapshots that back the image uses a configuration that Amazon Inspector can't read, such as Logical Volume Manager (LVM). + + * **Collection time limit exceeded** – Amazon Inspector timed out while collecting the software inventory from the snapshots that back the machine image. + + * **Image size exceeded** – The combined size of the snapshots that back the machine image exceeds the limit that Amazon Inspector supports for scanning. + + * **Internal error** – An internal error occurred when Amazon Inspector attempted to scan the machine image. Amazon Inspector will automatically address the error and resume scanning as soon as possible. + + + +