AWS inspector: Removes AmazonInspector2AmiServiceRolePolicy from managed policies page
Summary
Deletes the section documenting the AWS managed policy AmazonInspector2AmiServiceRolePolicy (EC2/EBS/KMS permissions used by the machine image scanning service-linked role), removes it from the page's policy list, and drops its entry from the policy-update changelog table.
Security assessment
The change removes documentation of a service-linked role policy that granted ec2/ebs read access and KMS decrypt permissions over EBS snapshots. This is an IAM permission-surface documentation removal (likely reflecting deprecation of AMI scanning), not a fix for a vulnerability or incident; no CVE, advisory, or exploit reference appears in the diff.
Evidence
- * `kms` – Allows Amazon Inspector to use select decryption actions to decrypt snapshots that are encrypted with AWS KMS customer managed keys.
Diff
diff --git a/inspector/latest/user/security-iam-awsmanpol.md b/inspector/latest/user/security-iam-awsmanpol.md index 4b23610..fcc8dff 100644 --- a//inspector/latest/user/security-iam-awsmanpol.md +++ b//inspector/latest/user/security-iam-awsmanpol.md @@ -7 +7 @@ -AmazonInspector2FullAccess_v2AWSInspector2OrganizationsAccessAmazonInspector2FullAccessAmazonInspector2ReadOnlyAccessAmazonInspector2ManagedCisPolicyAmazonInspector2ServiceRolePolicyAmazonInspector2AgentlessServiceRolePolicyAmazonInspector2AmiServiceRolePolicyAmazonInspector2ThirdPartyServiceRolePolicyAmazonInspector2ManagedTelemetryPolicyPolicy updates +AmazonInspector2FullAccess_v2AWSInspector2OrganizationsAccessAmazonInspector2FullAccessAmazonInspector2ReadOnlyAccessAmazonInspector2ManagedCisPolicyAmazonInspector2ServiceRolePolicyAmazonInspector2AgentlessServiceRolePolicyAmazonInspector2ThirdPartyServiceRolePolicyAmazonInspector2ManagedTelemetryPolicyPolicy updates @@ -200,19 +199,0 @@ You can't attach the `AmazonInspector2AgentlessServiceRolePolicy` policy to your -## AWS managed policy: AmazonInspector2AmiServiceRolePolicy - -You can't attach the `AmazonInspector2AmiServiceRolePolicy` policy to your IAM entities. This policy is attached to a service-linked role that allows Amazon Inspector to perform actions on your behalf for machine image scanning. For more information, see [Service-linked role permissions for Amazon Inspector machine image scans](./slr-permissions-ami.html). - -**Permissions details** - -This policy includes the following permissions. - - * `ec2` – Allows Amazon Inspector to retrieve information about the machine images that your account owns and the snapshots that back them. - - * `ebs` – Allows Amazon Inspector to read the contents of the snapshots that back your machine images. Unlike agentless Amazon EC2 scanning, machine image scanning doesn't create new snapshots. - - * `kms` – Allows Amazon Inspector to use select decryption actions to decrypt snapshots that are encrypted with AWS KMS customer managed keys. - - - - -To review the permissions for this policy, see [AmazonInspector2AmiServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonInspector2AmiServiceRolePolicy.html) in the _AWS Managed Policy Reference Guide_. - @@ -244 +224,0 @@ Change | Description | Date -AmazonInspector2AmiServiceRolePolicy – New policy | Amazon Inspector has added a new service-linked role policy to allow scanning of the machine images (AMIs) that your account owns. The policy allows Amazon Inspector to retrieve information about your machine images and the Amazon EBS snapshots that back them, read the contents of those snapshots, and decrypt snapshots that are encrypted with AWS KMS customer managed keys. | September 8, 2026