AWS inspector: Document new AmazonInspector2AmiServiceRolePolicy managed policy
Summary
Adds a section and changelog entry for the new AWS managed policy AmazonInspector2AmiServiceRolePolicy, describing ec2, ebs, and kms permissions attached to a service-linked role used for AMI scanning.
Security assessment
The new page documents the permissions of a service-linked role policy, including reading EBS snapshot contents and using KMS decryption actions on customer managed keys. This is IAM authorization documentation that helps users understand what privileges the service-linked role grants, but it does not fix or reference a specific vulnerability or incident.
Evidence
+ * `kms` – Allows Amazon Inspector to use select decryption actions to decrypt snapshots that are encrypted with AWS KMS customer managed keys.
Diff
diff --git a/inspector/latest/user/security-iam-awsmanpol.md b/inspector/latest/user/security-iam-awsmanpol.md index fcc8dff..4b23610 100644 --- a//inspector/latest/user/security-iam-awsmanpol.md +++ b//inspector/latest/user/security-iam-awsmanpol.md @@ -7 +7 @@ -AmazonInspector2FullAccess_v2AWSInspector2OrganizationsAccessAmazonInspector2FullAccessAmazonInspector2ReadOnlyAccessAmazonInspector2ManagedCisPolicyAmazonInspector2ServiceRolePolicyAmazonInspector2AgentlessServiceRolePolicyAmazonInspector2ThirdPartyServiceRolePolicyAmazonInspector2ManagedTelemetryPolicyPolicy updates +AmazonInspector2FullAccess_v2AWSInspector2OrganizationsAccessAmazonInspector2FullAccessAmazonInspector2ReadOnlyAccessAmazonInspector2ManagedCisPolicyAmazonInspector2ServiceRolePolicyAmazonInspector2AgentlessServiceRolePolicyAmazonInspector2AmiServiceRolePolicyAmazonInspector2ThirdPartyServiceRolePolicyAmazonInspector2ManagedTelemetryPolicyPolicy updates @@ -199,0 +200,19 @@ You can't attach the `AmazonInspector2AgentlessServiceRolePolicy` policy to your +## AWS managed policy: AmazonInspector2AmiServiceRolePolicy + +You can't attach the `AmazonInspector2AmiServiceRolePolicy` policy to your IAM entities. This policy is attached to a service-linked role that allows Amazon Inspector to perform actions on your behalf for machine image scanning. For more information, see [Service-linked role permissions for Amazon Inspector machine image scans](./slr-permissions-ami.html). + +**Permissions details** + +This policy includes the following permissions. + + * `ec2` – Allows Amazon Inspector to retrieve information about the machine images that your account owns and the snapshots that back them. + + * `ebs` – Allows Amazon Inspector to read the contents of the snapshots that back your machine images. Unlike agentless Amazon EC2 scanning, machine image scanning doesn't create new snapshots. + + * `kms` – Allows Amazon Inspector to use select decryption actions to decrypt snapshots that are encrypted with AWS KMS customer managed keys. + + + + +To review the permissions for this policy, see [AmazonInspector2AmiServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonInspector2AmiServiceRolePolicy.html) in the _AWS Managed Policy Reference Guide_. + @@ -224,0 +244 @@ Change | Description | Date +AmazonInspector2AmiServiceRolePolicy – New policy | Amazon Inspector has added a new service-linked role policy to allow scanning of the machine images (AMIs) that your account owns. The policy allows Amazon Inspector to retrieve information about your machine images and the Amazon EBS snapshots that back them, read the contents of those snapshots, and decrypt snapshots that are encrypted with AWS KMS customer managed keys. | September 8, 2026