AWS inspector: Note on-demand AMI scan findings only surface via EventBridge
Summary
Adds a note that findings from on-demand machine image scans are delivered only through Amazon EventBridge: they are absent from the Inspector console, are not returned by ListFindings, and are not sent to Security Hub CSPM.
Security assessment
The note warns of a visibility gap: these vulnerability findings bypass the console, ListFindings API, and Security Hub CSPM aggregation, so existing detection/monitoring pipelines could silently miss them unless EventBridge rules are configured. This is audit/aggregation-impacting guidance rather than a fix for a specific vulnerability.
Evidence
+Findings from on-demand machine image scans are an exception. Amazon Inspector delivers them only through Amazon EventBridge, so they don't appear in the Amazon Inspector console, aren't returned by `ListFindings`, and aren't sent to Security Hub CSPM. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html).
Diff
diff --git a/inspector/latest/user/findings-understanding-locating-analyzing.md b/inspector/latest/user/findings-understanding-locating-analyzing.md index 0a16cbd..b0bdc43 100644 --- a//inspector/latest/user/findings-understanding-locating-analyzing.md +++ b//inspector/latest/user/findings-understanding-locating-analyzing.md @@ -10,0 +11,4 @@ You can view findings in the Amazon Inspector console and with the Amazon Inspec +###### Note + +Findings from on-demand machine image scans are an exception. Amazon Inspector delivers them only through Amazon EventBridge, so they don't appear in the Amazon Inspector console, aren't returned by `ListFindings`, and aren't sent to Security Hub CSPM. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). +