AWS inspector: Add MACHINE_IMAGE resource type to Inspector deactivate scans
Summary
Documents deactivating Amazon Inspector machine image scanning (stops monitoring, removes from coverage, deletes scan configuration, reverts to default config on reactivation) and adds `MACHINE_IMAGE` to the list of `resourceTypes` accepted by the Disable API operation.
Security assessment
The only functional change is enumerating a new `MACHINE_IMAGE` resource type for the Inspector Disable API and describing deactivation behavior for AMI scanning. It is security-adjacent because it concerns vulnerability-scanning coverage, but it addresses no vulnerability, credential, encryption, or authorization concern and reduces rather than adds security guidance.
Evidence
+Run the [Disable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Disable.html) API operation. In the request, provide the account IDs you are deactivating scans for, and for `resourceTypes` provide one or more of `EC2`, `MACHINE_IMAGE`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` to deactivate scans.
Diff
diff --git a/inspector/latest/user/deactivate-scans.md b/inspector/latest/user/deactivate-scans.md index af90ee5..d1ec180 100644 --- a//inspector/latest/user/deactivate-scans.md +++ b//inspector/latest/user/deactivate-scans.md @@ -31,0 +32,4 @@ Additionally, the Amazon Inspector SSM plugin is removed from all Windows hosts. +###### [Machine image scanning](https://docs.aws.amazon.com/inspector/latest/user/scanning-machine-images.html) + +When you deactivate machine image scanning for an account, Amazon Inspector stops monitoring the machine images in that account, removes them from your coverage, and deletes the machine image scan configuration for the account. If you reactivate machine image scanning later, Amazon Inspector applies the default scan configuration. + @@ -75 +79 @@ API -Run the [Disable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Disable.html) API operation. In the request, provide the account IDs you are deactivating scans for, and for `resourceTypes` provide one or more of `EC2`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` to deactivate scans. +Run the [Disable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Disable.html) API operation. In the request, provide the account IDs you are deactivating scans for, and for `resourceTypes` provide one or more of `EC2`, `MACHINE_IMAGE`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` to deactivate scans.