AWS inspector: Document AWSServiceRoleForAmazonInspector2Ami SLR lifecycle
Summary
Adds a new section covering creation, editing, and deletion of the AWSServiceRoleForAmazonInspector2Ami service-linked role used for machine image scanning, including that Inspector blocks role deletion while an on-demand scan is in progress and requires disabling scanning in all Regions first.
Security assessment
The change documents an IAM service-linked role (least-privilege identity used by the service), its lifecycle, and deletion guardrails tied to in-progress scans. No vulnerability or incident is referenced, so it is security-adjacent IAM documentation rather than a fix.
Evidence
+You don't need to manually create the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. When you enable machine image scanning in Amazon Inspector, Amazon Inspector automatically creates the service-linked role for you.
Diff
diff --git a/inspector/latest/user/using-service-linked-roles.md b/inspector/latest/user/using-service-linked-roles.md index 5ba8a0e..9e90e8e 100644 --- a//inspector/latest/user/using-service-linked-roles.md +++ b//inspector/latest/user/using-service-linked-roles.md @@ -7 +7 @@ -Creating a service-linked role for Amazon InspectorEditing a service-linked role for Amazon InspectorDeleting a service-linked role for Amazon InspectorCreating a service-linked role for agentless scanningEditing a service-linked role for agentless scanningDeleting a service-linked role for agentless scanningCreating a service-linked role for multi-cloud scanningEditing a service-linked role for multi-cloud scanningDeleting a service-linked role for multi-cloud scanning +Creating a service-linked role for Amazon InspectorEditing a service-linked role for Amazon InspectorDeleting a service-linked role for Amazon InspectorCreating a service-linked role for agentless scanningEditing a service-linked role for agentless scanningDeleting a service-linked role for agentless scanningCreating a service-linked role for machine image scanningEditing a service-linked role for machine image scanningDeleting a service-linked role for machine image scanningCreating a service-linked role for multi-cloud scanningEditing a service-linked role for multi-cloud scanningDeleting a service-linked role for multi-cloud scanning @@ -58,0 +59,26 @@ Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleFor +## Creating a service-linked role for machine image scanning + +You don't need to manually create the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. When you enable machine image scanning in Amazon Inspector, Amazon Inspector automatically creates the service-linked role for you. + +Amazon Inspector also creates this role automatically the first time you call the [StartOnDemandScan](https://docs.aws.amazon.com/inspector/v2/APIReference/API_StartOnDemandScan.html) API operation for a machine image, even if you haven't enabled machine image scanning for the account. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). + +## Editing a service-linked role for machine image scanning + +Amazon Inspector does not allow you to edit the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. After a service-linked role is created, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role by using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. + +## Deleting a service-linked role for machine image scanning + +If you no longer need to use machine image scanning, we recommend that you delete the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. That way you don't have an unused entity that isn't actively monitored or maintained. + +###### Important + +In order to delete the `AWSServiceRoleForAmazonInspector2Ami` role, you must first disable machine image scanning in all Regions where it is enabled. + +###### Important + +Amazon Inspector also blocks deletion of the `AWSServiceRoleForAmazonInspector2Ami` role while an on-demand machine image scan is in progress in any AWS Region, so that the scan can finish. If you attempt to delete the role while a scan is in progress, the deletion fails. Wait for your on-demand scans to reach a terminal state, and then try the deletion again. To check whether a scan is still running, use the [GetOnDemandScanStatus](https://docs.aws.amazon.com/inspector/v2/APIReference/API_GetOnDemandScanStatus.html) API operation. + +**To manually delete the service-linked role using IAM** + +Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForAmazonInspector2Ami service-linked role. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the _IAM User Guide_. +