AWS imagebuilder: Document Amazon Inspector activation and container scan prerequisites
Summary
Adds guidance that image scanning requires Amazon Inspector to be activated (EC2 for AMIs, ECR for containers), documents request-time validation errors (ResourceDependencyException, UnsupportedOperationException, ResourceNotFoundException), prerequisites for container image scanning (existing ECR repo, no MANUAL scan frequency), recipe-type-specific scanning configuration, and notes that findings snapshots are encrypted at rest with an Image Builder-owned KMS key.
Security assessment
The change documents a security feature (Amazon Inspector vulnerability scanning) and its activation/prerequisite requirements, plus encryption at rest of findings snapshots. It is best-practice/feature documentation rather than a fix for a specific vulnerability or incident, so it is security documentation with medium impact.
Evidence
+Image Builder encrypts the findings snapshot for an image at rest with a KMS key that Image Builder owns.
Diff
diff --git a/imagebuilder/latest/userguide/integ-inspector.md b/imagebuilder/latest/userguide/integ-inspector.md index 54b0f36..5509ea3 100644 --- a//imagebuilder/latest/userguide/integ-inspector.md +++ b//imagebuilder/latest/userguide/integ-inspector.md @@ -11 +11 @@ When you activate security scanning with Amazon Inspector, it continuously scans -When Amazon Inspector discovers vulnerabilities in your software or network settings, it takes the following actions: +When Amazon Inspector discovers vulnerabilities in your software, it takes the following actions: @@ -41,0 +42,25 @@ To configure security scans for your pipeline, see [Configure security scans for +###### Amazon Inspector activation required + +Image scanning requires that Amazon Inspector is activated for your account in the AWS Region where you build your image: for Amazon EC2 (`ec2`) resources for AMI images, or for Amazon ECR (`ecr`) resources for container images. When a **CreateImage** , **CreateImagePipeline** , or **UpdateImagePipeline** request enables scanning, Image Builder checks the activation before it accepts the request. The request fails with `ResourceDependencyException` if Amazon Inspector isn't activated for the required resource type, or with `UnsupportedOperationException` if Amazon Inspector isn't available in the Region. For more information, see [Getting started tutorial: Activating Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/getting_started_tutorial.html) in the _Amazon Inspector User Guide_. + +Because Image Builder doesn't repeat the check when it runs an existing pipeline, later builds save no security findings if you deactivate Amazon Inspector for your account after you create a pipeline that has scanning enabled. For the scan status that Image Builder reports in this case, see [Image scan status and failure reasons](./image-security-findings.html#image-scan-status-failure-reasons). + +###### Choose the scanning configuration for your recipe type + +The `ecrConfiguration` field applies only to container images. For AMI images, set `imageScanningEnabled` to `true` and omit `ecrConfiguration`. For all scanning fields and the error that Image Builder returns if you specify `ecrConfiguration` for an AMI image, see [Create custom images with Image Builder](./create-images.html). For how Amazon Inspector scans Amazon EC2 instances, see [Scanning Amazon EC2 instances with Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/scanning-ec2.html) in the _Amazon Inspector User Guide_. + +###### Prerequisites for container image scanning + +For a container recipe, Image Builder checks the following before it accepts the request. + + * **Amazon Inspector must be activated for Amazon ECR** – For instructions, see [Activating a scan type](https://docs.aws.amazon.com/inspector/latest/user/activate-scans.html) in the _Amazon Inspector User Guide_. + + * **A repository that you name must already exist** – If you set `repositoryName`, the Amazon ECR repository must already exist in the same account and Region, or the request fails with `ResourceNotFoundException`. + + * **A repository that you name must not use`MANUAL` scan frequency** – If the repository uses a `MANUAL` scan frequency, the request fails with `ResourceDependencyException`. Use scan on push or continuous scanning. + + + + +If you omit `repositoryName`, Image Builder uses the default repository `image-builder-image-scanning-repository` and creates it if it doesn't exist. To learn when Image Builder removes the image that it pushes, see [Create custom images with Image Builder](./create-images.html). + @@ -46 +71,3 @@ In the Image Builder console, you can view security findings for all of your Ima -To learn more about Amazon Inspector vulnerability findings, see [Understanding findings in Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/findings-understanding.html) in the _Amazon Inspector User Guide_. +To learn more about Amazon Inspector vulnerability findings, see [Understanding Amazon Inspector findings](https://docs.aws.amazon.com/inspector/latest/user/findings-understanding.html) in the _Amazon Inspector User Guide_. + +Image Builder encrypts the findings snapshot for an image at rest with a KMS key that Image Builder owns.