AWS inspector: Document machine image scanning and on-demand scan findings delivery
Summary
Adds a note that machine image scanning and Code Security are opt-in scan types, a link to the machine image scanning doc, a section describing how machine image scanning discovers owned AMIs and scans their backing EBS snapshots continuously, and a note that on-demand machine image scan findings are delivered only via Amazon EventBridge and are absent from the console, ListFindings, and Security Hub CSPM.
Security assessment
Documents a vulnerability-scanning capability and explicitly flags a detection/visibility gap: on-demand machine image findings never reach the console, ListFindings, or Security Hub CSPM, so responders relying on those channels could miss vulnerabilities. No specific vulnerability or incident is referenced.
Evidence
Findings from on-demand machine image scans are an exception. Amazon Inspector delivers them only through Amazon EventBridge, so they don't appear in the Amazon Inspector console, aren't returned by `ListFindings`, and aren't sent to Security Hub CSPM.
Diff
diff --git a/inspector/latest/user/scanning-resources.md b/inspector/latest/user/scanning-resources.md index ecb7a2e..65f62d4 100644 --- a//inspector/latest/user/scanning-resources.md +++ b//inspector/latest/user/scanning-resources.md @@ -16,0 +17,4 @@ Lambda code scanning is an optional layer of Lambda function scanning that you c +###### Note + +Machine image scanning and Code Security for Amazon Inspector are optional scan types that you activate separately. Your account isn't automatically enrolled in them when you activate Amazon Inspector for the first time. + @@ -24,0 +29,2 @@ Lambda code scanning is an optional layer of Lambda function scanning that you c + * [Scanning machine images with Amazon Inspector](./scanning-machine-images.html) + @@ -42,0 +49,11 @@ When you activate Amazon EC2 scanning, Amazon Inspector scans your EC2 instances +**Machine image scanning** + + +When you activate machine image scanning, Amazon Inspector discovers the machine images (AMIs) that your account owns and scans them for operating system and programming language package vulnerabilities. Amazon Inspector collects a software inventory from the Amazon EBS snapshots that back each machine image, so you don't need to launch an instance from an image for Amazon Inspector to scan it. By default, machine image scanning is continuous: Amazon Inspector scans new images as you create, copy, register, or enable them, and rescans in-scope images when new CVEs are published. You control which images are in scope with scan eligibility windows, a scan mode, and exclusion options. For more information, see [Scanning machine images with Amazon Inspector](./scanning-machine-images.html). + +You can also scan a single machine image on demand, without activating Amazon Inspector. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). + +###### Note + +Findings from on-demand machine image scans are an exception. Amazon Inspector delivers them only through Amazon EventBridge, so they don't appear in the Amazon Inspector console, aren't returned by `ListFindings`, and aren't sent to Security Hub CSPM. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). +