AWS inspector: Document machine image scanning as optional scan type
Summary
Adds a note that machine image scanning and Code Security are opt-in, a link to machine image scanning, and a section describing continuous AMI scanning, EBS snapshot inventory collection, and on-demand scan finding delivery.
Security assessment
Describes a new vulnerability-scanning capability (AMI scanning, CVE rescans) and its opt-in nature; it is security feature documentation rather than remediation of a specific flaw.
Evidence
+When you activate machine image scanning, Amazon Inspector discovers the machine images (AMIs) that your account owns and scans them for operating system and programming language package vulnerabilities. Amazon Inspector collects a software inventory from the Amazon EBS snapshots that back each machine image, so you don't need to launch an instance from an image for Amazon Inspector to scan it. By default, machine image scanning is continuous: Amazon Inspector scans new images as you create, copy, register, or enable them, and rescans in-scope images when new CVEs are published. You control which images are in scope with scan eligibility windows, a scan mode, and exclusion options. For more information, see [Scanning machine images with Amazon Inspector](./scanning-machine-images.html).
Diff
diff --git a/inspector/latest/user/scanning-resources.md b/inspector/latest/user/scanning-resources.md index bbce0b8..149f6e5 100644 --- a//inspector/latest/user/scanning-resources.md +++ b//inspector/latest/user/scanning-resources.md @@ -16,0 +17,4 @@ Lambda code scanning is an optional layer of Lambda function scanning that you c +###### Note + +Machine image scanning and Code Security for Amazon Inspector are optional scan types that you activate separately. Your account isn't automatically enrolled in them when you activate Amazon Inspector for the first time. + @@ -24,0 +29,2 @@ Lambda code scanning is an optional layer of Lambda function scanning that you c + * [Scanning machine images with Amazon Inspector](./scanning-machine-images.html) + @@ -42,0 +49,11 @@ When you activate Amazon EC2 scanning, Amazon Inspector scans your EC2 instances +**Machine image scanning** + + +When you activate machine image scanning, Amazon Inspector discovers the machine images (AMIs) that your account owns and scans them for operating system and programming language package vulnerabilities. Amazon Inspector collects a software inventory from the Amazon EBS snapshots that back each machine image, so you don't need to launch an instance from an image for Amazon Inspector to scan it. By default, machine image scanning is continuous: Amazon Inspector scans new images as you create, copy, register, or enable them, and rescans in-scope images when new CVEs are published. You control which images are in scope with scan eligibility windows, a scan mode, and exclusion options. For more information, see [Scanning machine images with Amazon Inspector](./scanning-machine-images.html). + +You can also scan a single machine image on demand, without activating Amazon Inspector. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). + +###### Note + +Findings from on-demand machine image scans are an exception. Amazon Inspector delivers them only through Amazon EventBridge, so they don't appear in the Amazon Inspector console, aren't returned by `ListFindings`, and aren't sent to Security Hub CSPM. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). +