AWS inspector: Remove machine image coverage guidance from Inspector docs
Summary
Removed the 'Assessing coverage of machine images' topic, the Machine images tab references in the coverage procedure and topic list, and the machine image scanning status value list (including statuses such as Access denied, Excluded by tag, and Scan eligibility expired).
Security assessment
This is a deletion of coverage/status documentation for the machine image scan type; while removed statuses like 'Access denied' touch on permissions, the edit removes rather than adds security guidance and addresses no specific vulnerability or incident.
Evidence
-## Assessing coverage of machine images
Diff
diff --git a/inspector/latest/user/assessing-coverage.md b/inspector/latest/user/assessing-coverage.md index d04ef61..293001a 100644 --- a//inspector/latest/user/assessing-coverage.md +++ b//inspector/latest/user/assessing-coverage.md @@ -7 +7 @@ -Assessing account-level coverageAssessing coverage of Amazon EC2 instancesAssessing coverage of Amazon ECR repositoriesAssessing coverage of Amazon ECR container imagesAssessing coverage of AWS Lambda functionsAssessing coverage of machine images +Assessing account-level coverageAssessing coverage of Amazon EC2 instancesAssessing coverage of Amazon ECR repositoriesAssessing coverage of Amazon ECR container imagesAssessing coverage of AWS Lambda functions @@ -31,2 +30,0 @@ The following procedure describes how to assess coverage of your Amazon Inspecto - * Choose **Machine images** to review coverage for the machine images (AMIs) that your accounts own. - @@ -56,2 +53,0 @@ The following topics describe the information each of these tabs provide. - * Assessing coverage of machine images - @@ -271,42 +266,0 @@ For a Lambda function, the possible **Status** values are: -## Assessing coverage of machine images - -The **Machine images** tab shows the machine images (AMIs) that your accounts own. You can group machine images based on the following tabs: - - * **All** – Shows all the machine images that your accounts own. The **Status** column indicates the current scanning status for a machine image. - - * **Scanning** – Shows the machine images that Amazon Inspector is configured to scan. The **Status** column indicates the current scanning status for each machine image. - - * **Not scanning** – Shows the machine images that Amazon Inspector is not configured to scan. The **Reason** column indicates why Amazon Inspector is not monitoring and scanning a machine image. - -A machine image can appear on the **Not scanning** tab for several reasons. Your scan configuration might exclude the image, its operating system or file system might not be supported, or it might fall outside of your scan eligibility windows. For more information, see [Machine image scanning](./scanning-machine-images.html). - - - - -On each tab, the **Machine image** column specifies the ID of the machine image. The **Account** column specifies the AWS account that owns the machine image. **Operating system** specifies the platform of the machine image. The **Status** column indicates the current scanning status for each machine image. **Resource tags** shows the tags that have been applied to the machine image. The **Last scanned** column shows you when Amazon Inspector last checked that machine image for vulnerabilities. For more information, see [Scan behaviors for machine image scanning](./scanning-machine-images.html#machine-image-scan-behavior). - -### Scanning status values for machine images - -For a machine image, the possible **Status** values are: - - * **Actively monitoring** – Amazon Inspector is continuously monitoring and scanning the machine image. Continuous scanning includes an initial scan when you create, copy, register, or enable the machine image, and automated rescans when new Common Vulnerabilities and Exposures (CVEs) are released. - - * **Pending initial scan** – Amazon Inspector has queued the machine image for an initial scan. - - * **Excluded by tag** – Amazon Inspector isn't scanning this machine image because your scan mode or your exclusion options exclude it. In continuous (`SCAN_ALL`) mode, the image carries your configured exclusion tag. Amazon Inspector also reports this reason when the image is a copy of another image or AWS Data Lifecycle Manager created it, and you chose to exclude copied or backup images. For more information, see [Managing machine image scan mode](./machine-image-scan-configuration.html#machine-image-scan-mode) and [Excluding copied and backup machine images](./machine-image-scan-configuration.html#machine-image-exclusions). - - * **Scan eligibility expired** – Amazon Inspector is not monitoring this machine image because it falls outside of both of your scan eligibility windows. For more information, see [Setting scan eligibility windows](./machine-image-scan-configuration.html#machine-image-eligibility-windows). - - * **Access denied** – Amazon Inspector couldn't access the machine image or the snapshots that back it. - - * **Unsupported operating system** – The operating system of the machine image isn't supported for scanning, or one or more of the snapshots that back the image uses a configuration that Amazon Inspector can't read, such as Logical Volume Manager (LVM). - - * **Collection time limit exceeded** – Amazon Inspector timed out while collecting the software inventory from the snapshots that back the machine image. - - * **Image size exceeded** – The combined size of the snapshots that back the machine image exceeds the limit that Amazon Inspector supports for scanning. - - * **Internal error** – An internal error occurred when Amazon Inspector attempted to scan the machine image. Amazon Inspector will automatically address the error and resume scanning as soon as possible. - - - -