AWS inspector: Remove machine image scanning section; update ECR re-scan duration text
Summary
Deletes the machine image scanning overview, the note that machine image scanning and Code Security are separately activated optional scan types, the on-demand machine image findings caveat, and the machine-images link; rewrites the ECR scanning paragraph to describe the configurable re-scan duration (14-day default for new accounts, 90 days for accounts created before May 16, 2024).
Security assessment
The diff is a content reorganization: it removes the machine image scanning description/notes and restates the ECR re-scan duration defaults. It describes existing scanning behavior rather than introducing or fixing a security control, so it is documentation maintenance with no concrete vulnerability or incident referenced.
Evidence
+When you activate Amazon ECR scanning, Amazon Inspector converts all of the repositories in your private registry from basic scanning container repositories to enhanced scanning repositories. You can configure this setting with inclusion rules to scan on-push only or to scan select repositories. Amazon Inspector only scans ECR container images which are active (`imageStatus` field is `ACTIVE`) in ECR. Amazon Inspector scans all images pushed or transitioned to active (`lastActivatedAt`) in ECR, or pulled, within the configured re-scan duration. The default re-scan duration for new accounts, including new accounts added to an organization, is 14 days. For Amazon Inspector accounts created prior to May 16, 2024, the default configuration monitors images that were pushed or pulled within the last 90 days. You can change this setting at any time. For more information, see [Scanning Amazon Elastic Container Registry container images with Amazon Inspector](./scanning-ecr.html).
Diff
diff --git a/inspector/latest/user/scanning-resources.md b/inspector/latest/user/scanning-resources.md index 65f62d4..9ae7840 100644 --- a//inspector/latest/user/scanning-resources.md +++ b//inspector/latest/user/scanning-resources.md @@ -17,4 +16,0 @@ Lambda code scanning is an optional layer of Lambda function scanning that you c -###### Note - -Machine image scanning and Code Security for Amazon Inspector are optional scan types that you activate separately. Your account isn't automatically enrolled in them when you activate Amazon Inspector for the first time. - @@ -29,2 +24,0 @@ Machine image scanning and Code Security for Amazon Inspector are optional scan - * [Scanning machine images with Amazon Inspector](./scanning-machine-images.html) - @@ -49,11 +42,0 @@ When you activate Amazon EC2 scanning, Amazon Inspector scans your EC2 instances -**Machine image scanning** - - -When you activate machine image scanning, Amazon Inspector discovers the machine images (AMIs) that your account owns and scans them for operating system and programming language package vulnerabilities. Amazon Inspector collects a software inventory from the Amazon EBS snapshots that back each machine image, so you don't need to launch an instance from an image for Amazon Inspector to scan it. By default, machine image scanning is continuous: Amazon Inspector scans new images as you create, copy, register, or enable them, and rescans in-scope images when new CVEs are published. You control which images are in scope with scan eligibility windows, a scan mode, and exclusion options. For more information, see [Scanning machine images with Amazon Inspector](./scanning-machine-images.html). - -You can also scan a single machine image on demand, without activating Amazon Inspector. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). - -###### Note - -Findings from on-demand machine image scans are an exception. Amazon Inspector delivers them only through Amazon EventBridge, so they don't appear in the Amazon Inspector console, aren't returned by `ListFindings`, and aren't sent to Security Hub CSPM. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). - @@ -63 +46 @@ Findings from on-demand machine image scans are an exception. Amazon Inspector d -When you activate Amazon ECR scanning, Amazon Inspector converts all of the repositories in your private registry from basic scanning container repositories to enhanced scanning repositories. You can configure this setting with inclusion rules to scan on-push only or to scan select repositories. Amazon Inspector only scans ECR container images which are active (`imageStatus` field is `ACTIVE`) in ECR. Amazon Inspector scans all images pushed or transitioned to active (`lastActivatedAt`) in ECR within the last 30 days or pulled within the last 90 days. Amazon Inspector continues to monitor images for 90 days by default. You can change this setting at any time. For more information, see [Scanning Amazon Elastic Container Registry container images with Amazon Inspector](./scanning-ecr.html). +When you activate Amazon ECR scanning, Amazon Inspector converts all of the repositories in your private registry from basic scanning container repositories to enhanced scanning repositories. You can configure this setting with inclusion rules to scan on-push only or to scan select repositories. Amazon Inspector only scans ECR container images which are active (`imageStatus` field is `ACTIVE`) in ECR. Amazon Inspector scans all images pushed or transitioned to active (`lastActivatedAt`) in ECR, or pulled, within the configured re-scan duration. The default re-scan duration for new accounts, including new accounts added to an organization, is 14 days. For Amazon Inspector accounts created prior to May 16, 2024, the default configuration monitors images that were pushed or pulled within the last 90 days. You can change this setting at any time. For more information, see [Scanning Amazon Elastic Container Registry container images with Amazon Inspector](./scanning-ecr.html).