AWS inspector: Remove machine image scanning service-linked role docs
Summary
Deleted the sections describing creating, editing, and deleting the AWSServiceRoleForAmazonInspector2Ami service-linked role for machine image scanning, along with the corresponding table-of-contents entries.
Security assessment
The diff only removes pre-existing IAM service-linked-role documentation for the machine image scanning feature; it introduces no new permissions, trust policies, or credential guidance and references no vulnerability or advisory. IAM is tangentially involved because the deleted text described a service-linked role, but nothing security-relevant is added.
Evidence
-## Creating a service-linked role for machine image scanning
Diff
diff --git a/inspector/latest/user/using-service-linked-roles.md b/inspector/latest/user/using-service-linked-roles.md index 9e90e8e..5ba8a0e 100644 --- a//inspector/latest/user/using-service-linked-roles.md +++ b//inspector/latest/user/using-service-linked-roles.md @@ -7 +7 @@ -Creating a service-linked role for Amazon InspectorEditing a service-linked role for Amazon InspectorDeleting a service-linked role for Amazon InspectorCreating a service-linked role for agentless scanningEditing a service-linked role for agentless scanningDeleting a service-linked role for agentless scanningCreating a service-linked role for machine image scanningEditing a service-linked role for machine image scanningDeleting a service-linked role for machine image scanningCreating a service-linked role for multi-cloud scanningEditing a service-linked role for multi-cloud scanningDeleting a service-linked role for multi-cloud scanning +Creating a service-linked role for Amazon InspectorEditing a service-linked role for Amazon InspectorDeleting a service-linked role for Amazon InspectorCreating a service-linked role for agentless scanningEditing a service-linked role for agentless scanningDeleting a service-linked role for agentless scanningCreating a service-linked role for multi-cloud scanningEditing a service-linked role for multi-cloud scanningDeleting a service-linked role for multi-cloud scanning @@ -59,26 +58,0 @@ Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleFor -## Creating a service-linked role for machine image scanning - -You don't need to manually create the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. When you enable machine image scanning in Amazon Inspector, Amazon Inspector automatically creates the service-linked role for you. - -Amazon Inspector also creates this role automatically the first time you call the [StartOnDemandScan](https://docs.aws.amazon.com/inspector/v2/APIReference/API_StartOnDemandScan.html) API operation for a machine image, even if you haven't enabled machine image scanning for the account. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). - -## Editing a service-linked role for machine image scanning - -Amazon Inspector does not allow you to edit the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. After a service-linked role is created, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role by using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. - -## Deleting a service-linked role for machine image scanning - -If you no longer need to use machine image scanning, we recommend that you delete the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. That way you don't have an unused entity that isn't actively monitored or maintained. - -###### Important - -In order to delete the `AWSServiceRoleForAmazonInspector2Ami` role, you must first disable machine image scanning in all Regions where it is enabled. - -###### Important - -Amazon Inspector also blocks deletion of the `AWSServiceRoleForAmazonInspector2Ami` role while an on-demand machine image scan is in progress in any AWS Region, so that the scan can finish. If you attempt to delete the role while a scan is in progress, the deletion fails. Wait for your on-demand scans to reach a terminal state, and then try the deletion again. To check whether a scan is still running, use the [GetOnDemandScanStatus](https://docs.aws.amazon.com/inspector/v2/APIReference/API_GetOnDemandScanStatus.html) API operation. - -**To manually delete the service-linked role using IAM** - -Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForAmazonInspector2Ami service-linked role. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the _IAM User Guide_. -