AWS inspector: Document machine image scanning activation and MACHINE_IMAGE type
Summary
Adds a new scan-type section for Amazon Inspector machine image scanning (software inventory from EBS snapshots backing an AMI compared against security advisories), a note to review scan configuration to control which machine images are in scope, and updates the Enable API resourceTypes list to include MACHINE_IMAGE.
Security assessment
The diff documents activation of a vulnerability-scanning capability (machine image/AMI package vulnerability scanning) and adds the corresponding MACHINE_IMAGE resource type to the Enable API. It expands security-scanning coverage guidance (including scope configuration) rather than addressing a specific vulnerability or CVE.
Evidence
Run the [Enable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Enable.html) API operation. In the request, provide the account IDs you are activating scans for, and idempotency token, and one or more of `EC2`, `MACHINE_IMAGE`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` for `resourceTypes` to activate scans of that type.
Diff
diff --git a/inspector/latest/user/activate-scans.md b/inspector/latest/user/activate-scans.md index ae8bda2..d6e563c 100644 --- a//inspector/latest/user/activate-scans.md +++ b//inspector/latest/user/activate-scans.md @@ -16,0 +17,8 @@ This scan type extracts metadata from an Amazon EC2 instance before comparing th +###### [Machine image scanning](https://docs.aws.amazon.com/inspector/latest/user/scanning-machine-images.html) + +This scan type extracts a software inventory from the Amazon EBS snapshots that back a machine image (AMI) before comparing that inventory against rules collected from security advisories. When you activate this scan type, Amazon Inspector scans all eligible machine images that your account owns for package vulnerabilities and continues to monitor them. After you activate this scan type, you can view how many machine images are being scanned in the **Machine images** tab. + +###### Note + +After you activate machine image scanning, review your scan configuration to control which machine images are in scope. For more information, see [Configuring machine image scanning](./machine-image-scan-configuration.html). + @@ -66 +74 @@ API -Run the [Enable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Enable.html) API operation. In the request, provide the account IDs you are activating scans for, and idempotency token, and one or more of `EC2`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` for `resourceTypes` to activate scans of that type. +Run the [Enable](https://docs.aws.amazon.com/inspector/v2/APIReference/API_Enable.html) API operation. In the request, provide the account IDs you are activating scans for, and idempotency token, and one or more of `EC2`, `MACHINE_IMAGE`, `ECR`, `LAMBDA`, or `LAMBDA_CODE` for `resourceTypes` to activate scans of that type.