AWS inspector: Add AmazonInspector2AmiServiceRolePolicy managed policy documentation
Summary
Adds the new AmazonInspector2AmiServiceRolePolicy AWS managed policy to the policy index, a section describing its ec2, ebs, and kms permissions for machine image scanning (including reading snapshot contents and decrypting snapshots encrypted with customer managed KMS keys), and a policy-update changelog entry dated September 8, 2026.
Security assessment
Introduces a service-linked role policy granting access to machine image metadata, read access to backing EBS snapshots, and KMS decrypt permissions on customer managed keys — credential/encryption-adjacent IAM permissions with direct data-access implications. No specific vulnerability or CVE is referenced.
Evidence
* `kms` – Allows Amazon Inspector to use select decryption actions to decrypt snapshots that are encrypted with AWS KMS customer managed keys.
Diff
diff --git a/inspector/latest/user/security-iam-awsmanpol.md b/inspector/latest/user/security-iam-awsmanpol.md index fcc8dff..4b23610 100644 --- a//inspector/latest/user/security-iam-awsmanpol.md +++ b//inspector/latest/user/security-iam-awsmanpol.md @@ -7 +7 @@ -AmazonInspector2FullAccess_v2AWSInspector2OrganizationsAccessAmazonInspector2FullAccessAmazonInspector2ReadOnlyAccessAmazonInspector2ManagedCisPolicyAmazonInspector2ServiceRolePolicyAmazonInspector2AgentlessServiceRolePolicyAmazonInspector2ThirdPartyServiceRolePolicyAmazonInspector2ManagedTelemetryPolicyPolicy updates +AmazonInspector2FullAccess_v2AWSInspector2OrganizationsAccessAmazonInspector2FullAccessAmazonInspector2ReadOnlyAccessAmazonInspector2ManagedCisPolicyAmazonInspector2ServiceRolePolicyAmazonInspector2AgentlessServiceRolePolicyAmazonInspector2AmiServiceRolePolicyAmazonInspector2ThirdPartyServiceRolePolicyAmazonInspector2ManagedTelemetryPolicyPolicy updates @@ -199,0 +200,19 @@ You can't attach the `AmazonInspector2AgentlessServiceRolePolicy` policy to your +## AWS managed policy: AmazonInspector2AmiServiceRolePolicy + +You can't attach the `AmazonInspector2AmiServiceRolePolicy` policy to your IAM entities. This policy is attached to a service-linked role that allows Amazon Inspector to perform actions on your behalf for machine image scanning. For more information, see [Service-linked role permissions for Amazon Inspector machine image scans](./slr-permissions-ami.html). + +**Permissions details** + +This policy includes the following permissions. + + * `ec2` – Allows Amazon Inspector to retrieve information about the machine images that your account owns and the snapshots that back them. + + * `ebs` – Allows Amazon Inspector to read the contents of the snapshots that back your machine images. Unlike agentless Amazon EC2 scanning, machine image scanning doesn't create new snapshots. + + * `kms` – Allows Amazon Inspector to use select decryption actions to decrypt snapshots that are encrypted with AWS KMS customer managed keys. + + + + +To review the permissions for this policy, see [AmazonInspector2AmiServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonInspector2AmiServiceRolePolicy.html) in the _AWS Managed Policy Reference Guide_. + @@ -224,0 +244 @@ Change | Description | Date +AmazonInspector2AmiServiceRolePolicy – New policy | Amazon Inspector has added a new service-linked role policy to allow scanning of the machine images (AMIs) that your account owns. The policy allows Amazon Inspector to retrieve information about your machine images and the Amazon EBS snapshots that back them, read the contents of those snapshots, and decrypt snapshots that are encrypted with AWS KMS customer managed keys. | September 8, 2026