AWS inspector: Inspector ECR default re-scan duration changed to 7 days
Summary
Updates the Amazon Inspector ECR re-scan duration documentation: default re-scan duration for new accounts changes from 14 to 7 days, clarifies last-in-use vs last-pull modes, and notes the October 15, 2026 default change.
Security assessment
The change alters how long Inspector monitors container images for vulnerabilities (14 to 7 days default), which affects vulnerability detection coverage but does not address a specific vulnerability or incident.
Evidence
+As of October 15, 2026, the default re-scan duration when you activate Amazon ECR scanning is 7 days. Accounts that already have Amazon ECR scanning activated keep their current re-scan duration settings.
Diff
diff --git a/inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md b/inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md index f2a59eb..a26f7ac 100644 --- a//inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md +++ b//inspector/latest/user/scanning_resources_configure_duration_setting_ecr.md @@ -13 +13 @@ The Amazon ECR re-scan duration setting determines how long Amazon Inspector con -If you build images often, choose a shorter scan duration. For images used over long periods of time, choose a longer scan duration. The default scan duration for new accounts, including new accounts added to an organization, is 14 days. +If you build images often, choose a shorter scan duration. For images used over long periods of time, choose a longer scan duration. The default scan duration for new accounts, including new accounts added to an organization, is 7 days. @@ -15 +15 @@ If you build images often, choose a shorter scan duration. For images used over -Amazon Inspector will continue to monitor and rescan an image as long as it was last in use on a cluster or pushed within 14 days (by default). If an image hasn’t been pushed or last used on a running container within the configured push and last in use dates, Amazon Inspector stops monitoring it. There is an option to change the setting to monitor images by last pull date instead of the last in use date, if required. When Amazon Inspector stops monitoring an image, it sets the image scan status code to inactive and reason code to expired. Amazon Inspector then schedules all associated image findings to be closed. +Amazon Inspector continues to monitor and re-scan an image as long as it was last in use on a cluster or pushed within 7 days (by default). If an image hasn't been pushed or used on a running container within the configured push and last-in-use dates, Amazon Inspector stops monitoring it. There is an option to change the setting to monitor images by last pull date instead of the last-in-use date, if required. When Amazon Inspector stops monitoring an image, it sets the image scan status code to inactive and reason code to expired. Amazon Inspector then schedules all associated image findings to be closed. @@ -25 +25 @@ For multi-architecture images, the last-in-use date tracking is not supported. W -All re-scan duration settings configured prior to May 16, 2024, will remain unchanged. You can continue using any default settings previously configured. +As of October 15, 2026, the default re-scan duration when you activate Amazon ECR scanning is 7 days. Accounts that already have Amazon ECR scanning activated keep their current re-scan duration settings. @@ -29 +29 @@ All re-scan duration settings configured prior to May 16, 2024, will remain unch -The image re-scan duration determines how long Amazon Inspector will monitor images. The image re-scan duration includes two modes: **Last in use date** (default) or **Last pull date**. Choose **Last in use date** (default) if you want to use the last in use date from your Amazon ECS/Amazon EKS cluster activity. Choose **Last pull date** if you want to use the last pull date from your Amazon ECR images to re-scan images. The following options are available as re-scan durations: +The image re-scan duration determines how long Amazon Inspector monitors images. The image re-scan duration includes two modes: **Last in use date** (default) or **Last pull date**. Choose **Last in use date** (default) if you want to use the last-in-use date from your Amazon ECS/Amazon EKS cluster activity. Choose **Last pull date** if you want to use the last pull date from your Amazon ECR images to re-scan images. The following options are available as re-scan durations: @@ -33 +33 @@ The image re-scan duration determines how long Amazon Inspector will monitor ima - * 7 days + * 7 days (default) @@ -35 +35 @@ The image re-scan duration determines how long Amazon Inspector will monitor ima - * 14 days (default) + * 14 days @@ -54 +54 @@ The image push date duration determines how long Amazon Inspector will continuou - * 7 days + * 7 days (default) @@ -56 +56 @@ The image push date duration determines how long Amazon Inspector will continuou - * 14 days (default) + * 14 days @@ -92 +92 @@ Inspector only scans `ACTIVE` images in ECR container images. ECR container imag -When an ECR container image's image status in ECR transitions to `ACTIVE`, Inspector uses the `lastActivatedAt` field to monitor rescan duration. +When an ECR container image's image status in ECR transitions to `ACTIVE`, Inspector uses the `lastActivatedAt` field to monitor re-scan duration.