AWS imagebuilder: Image Builder: update Marketplace, CIS hardening, and Inspector guidance
Summary
Reworded AWS Marketplace image product guidance (dropped the 'CIS Hardening' example), changed the CIS companion-component note to instruct users to subscribe to a CIS hardening component in AWS Marketplace and add it to their recipe, and updated the Amazon Inspector description to cover scanning of the EC2 test instance and ECR container image copies, plus refreshed the Inspector doc links.
Security assessment
The change is documentation-only, updating wording and links. It does document a security hardening practice (using a CIS hardening component to enforce CIS Benchmarks Level 1) and clarifies that Amazon Inspector scans the test instance and ECR image copies for software vulnerabilities, but it addresses no specific vulnerability, CVE, or incident, so it is security-adjacent guidance rather than a fix.
Evidence
+ * **Image Builder components** – Components that you specify in your recipes can perform build and test actions, for example, to install software or perform compliance validation. Some image products that you subscribe to from AWS Marketplace might include a companion component that you can use in your recipes. To enforce CIS Benchmarks Level 1 guidelines for your configuration, subscribe to a CIS hardening component in AWS Marketplace, and add it to your recipe.
Diff
diff --git a/imagebuilder/latest/userguide/integrate-products-services.md b/imagebuilder/latest/userguide/integrate-products-services.md index d86e3a8..9eaf81a 100644 --- a//imagebuilder/latest/userguide/integrate-products-services.md +++ b//imagebuilder/latest/userguide/integrate-products-services.md @@ -15 +15 @@ Image Builder recipes can incorporate image products from AWS Marketplace and Im - * **AWS Marketplace image products** – Use an image product from AWS Marketplace as the base image in your recipe to meet organizational standards, such as CIS Hardening. When you create a recipe from the Image Builder console, you can choose from your existing subscriptions, or search for a specific product from AWS Marketplace. When you create a recipe from the Image Builder API, CLI, or SDK, you can specify an image product Amazon Resource Name (ARN) to use as your base image. + * **AWS Marketplace image products** – Use an image product from AWS Marketplace as the base image in your recipe to meet organizational standards. When you create a recipe from the Image Builder console, you can choose from your existing subscriptions, or search for a specific product from AWS Marketplace. When you create a recipe from the Image Builder API, CLI, or SDK, you can specify an image product Amazon Resource Name (ARN) to use as your base image. @@ -17 +17 @@ Image Builder recipes can incorporate image products from AWS Marketplace and Im - * **Image Builder components** – Components that you specify in your recipes can perform build and test actions, for example, to install software or perform compliance validation. Some image products that you subscribe to from AWS Marketplace might include a companion component that you can use in your recipes. The CIS Hardened images include a matching AWSTOE component that you can use in your recipe to enforce CIS Benchmarks Level 1 guidelines for your configuration. + * **Image Builder components** – Components that you specify in your recipes can perform build and test actions, for example, to install software or perform compliance validation. Some image products that you subscribe to from AWS Marketplace might include a companion component that you can use in your recipes. To enforce CIS Benchmarks Level 1 guidelines for your configuration, subscribe to a CIS hardening component in AWS Marketplace, and add it to your recipe. @@ -44 +44 @@ For more information about CloudWatch Logs, see [What is Amazon CloudWatch Logs? - * **Amazon Inspector** – Discover vulnerabilities in your software and network settings with automatic scans for the EC2 test instance that Image Builder launches create a new image. Image Builder saves findings for your output image resource so that you can investigate and remediate after your test instance terminates. For more information about scans and pricing, see [What is Amazon Inspector?](https://docs.aws.amazon.com/inspector/v1/userguide/inspector_introduction.html) in the _Amazon Inspector User Guide_. + * **Amazon Inspector** – Discover software vulnerabilities with automatic scans of the Amazon EC2 test instance that Image Builder launches from your new AMI, or of the copy of the container image that Image Builder pushes to Amazon ECR. Image Builder saves findings for your output image resource so that you can investigate and remediate after your test instance terminates. For more information about scans and pricing, see [What is Amazon Inspector?](https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html) in the _Amazon Inspector User Guide_. @@ -46 +46 @@ For more information about CloudWatch Logs, see [What is Amazon CloudWatch Logs? -Amazon Inspector can also scan your ECR repositories if you configure enhanced scanning. For more information, see [Scanning Amazon ECR container images](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html) in the _Amazon Inspector User Guide_. +Amazon Inspector can also scan your ECR repositories if you configure enhanced scanning. For more information, see [Scanning Amazon Elastic Container Registry container images with Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html) in the _Amazon Inspector User Guide_.