AWS inspector: Update default ECR re-scan duration to 7 days in Inspector docs
Summary
Revised the Amazon Inspector ECR scanning description: the default re-scan duration for new accounts (including new organization accounts) is now 7 days, and a 14-day default is documented for accounts that activated ECR scanning between May 16, 2024 and October 14, 2026. The prior 90-day legacy behavior for pre-May 16, 2024 accounts is retained.
Security assessment
The only changed content is the documented default re-scan duration (14 days -> 7 days for new accounts, with a new 14-day window for accounts activated between May 16, 2024 and October 14, 2026). This affects how frequently container images are re-evaluated for newly disclosed vulnerabilities, so it has security-relevant operational impact (detection window), but it does not fix a vulnerability, change IAM/authz, encryption, or credentials, and no CVE or incident is referenced.
Evidence
+When you activate Amazon ECR scanning, Amazon Inspector converts all of the repositories in your private registry from basic scanning container repositories to enhanced scanning repositories. You can configure this setting with inclusion rules to scan on-push only or to scan select repositories. Amazon Inspector only scans ECR container images which are active (`imageStatus` field is `ACTIVE`) in ECR. Amazon Inspector scans all images pushed or transitioned to active (`lastActivatedAt`) in ECR, or pulled, within the configured re-scan duration. The default re-scan duration for new accounts, including new accounts added to an organization, is 7 days. For accounts that activated Amazon ECR scanning from May 16, 2024, to October 14, 2026, the default re-scan duration is 14 days. For Amazon Inspector accounts created prior to May 16, 2024, the default configuration monitors images that were pushed or pulled within the last 90 days. You can change this setting at any time. For more information, see [Scanning Amazon Elastic Container Registry container images with Amazon Inspector](./scanning-ecr.html).
Diff
diff --git a/inspector/latest/user/scanning-resources.md b/inspector/latest/user/scanning-resources.md index 9ae7840..bbce0b8 100644 --- a//inspector/latest/user/scanning-resources.md +++ b//inspector/latest/user/scanning-resources.md @@ -46 +46 @@ When you activate Amazon EC2 scanning, Amazon Inspector scans your EC2 instances -When you activate Amazon ECR scanning, Amazon Inspector converts all of the repositories in your private registry from basic scanning container repositories to enhanced scanning repositories. You can configure this setting with inclusion rules to scan on-push only or to scan select repositories. Amazon Inspector only scans ECR container images which are active (`imageStatus` field is `ACTIVE`) in ECR. Amazon Inspector scans all images pushed or transitioned to active (`lastActivatedAt`) in ECR, or pulled, within the configured re-scan duration. The default re-scan duration for new accounts, including new accounts added to an organization, is 14 days. For Amazon Inspector accounts created prior to May 16, 2024, the default configuration monitors images that were pushed or pulled within the last 90 days. You can change this setting at any time. For more information, see [Scanning Amazon Elastic Container Registry container images with Amazon Inspector](./scanning-ecr.html). +When you activate Amazon ECR scanning, Amazon Inspector converts all of the repositories in your private registry from basic scanning container repositories to enhanced scanning repositories. You can configure this setting with inclusion rules to scan on-push only or to scan select repositories. Amazon Inspector only scans ECR container images which are active (`imageStatus` field is `ACTIVE`) in ECR. Amazon Inspector scans all images pushed or transitioned to active (`lastActivatedAt`) in ECR, or pulled, within the configured re-scan duration. The default re-scan duration for new accounts, including new accounts added to an organization, is 7 days. For accounts that activated Amazon ECR scanning from May 16, 2024, to October 14, 2026, the default re-scan duration is 14 days. For Amazon Inspector accounts created prior to May 16, 2024, the default configuration monitors images that were pushed or pulled within the last 90 days. You can change this setting at any time. For more information, see [Scanning Amazon Elastic Container Registry container images with Amazon Inspector](./scanning-ecr.html).