AWS inspector: Add machine image (AMI) scanning support and OS matrix
Summary
Documents that Amazon Inspector can now scan account-owned machine images, adds a note that toolchain vulnerabilities and macOS are unsupported, and adds a table of supported operating systems and advisory sources for machine image scanning.
Security assessment
The change documents vulnerability-scanning coverage (OS versions, advisory sources, unsupported configurations such as LVM and macOS) for AMI scanning, which is security-adjacent detection guidance rather than a fix for a specific weakness.
Evidence
+Machine image scanning doesn't use an agent. Amazon Inspector reads the software inventory directly from the Amazon EBS snapshots that back the image, so you don't need to install the SSM Agent or launch an instance from the image.
Diff
diff --git a/inspector/latest/user/supported.md b/inspector/latest/user/supported.md index 619166e..6e95077 100644 --- a//inspector/latest/user/supported.md +++ b//inspector/latest/user/supported.md @@ -18,0 +19,6 @@ For Amazon EC2 instances, Amazon Inspector can scan for package vulnerabilities + * Machine images (AMIs) that your account owns + +###### Note + +For machine images, Amazon Inspector can scan for operating system and programming language package vulnerabilities. For the operating systems that Amazon Inspector supports for machine image scanning, see Supported operating systems: machine image scanning. Amazon Inspector does not scan for toolchain vulnerabilities. The version of the programming language compiler used to build the application introduces these vulnerabilities. + @@ -142,0 +149,46 @@ macOS (Tahoe) | 26 | APPLE-SA | Fixed | No | Yes +### Supported operating systems: machine image scanning + +The following table lists the operating systems Amazon Inspector supports for the scanning of machine images (AMIs). It specifies the advisory source and advisory status for each operating system. + +Machine image scanning doesn't use an agent. Amazon Inspector reads the software inventory directly from the Amazon EBS snapshots that back the image, so you don't need to install the SSM Agent or launch an instance from the image. For more information, see [Scanning machine images with Amazon Inspector](./scanning-machine-images.html). + +Linux operating system detections are supported only for the default package manager repository (rpm and dpkg). Detections don't include third-party applications, extended support repositories, or optional repositories (application streams) unless otherwise specified below. + +###### Note + +Amazon Inspector doesn't support machine image scanning for macOS. Amazon Inspector reports a scan status of `UNSUPPORTED_OS` for a machine image that runs an operating system that isn't listed in the following table, and for a machine image whose snapshots use a configuration that Amazon Inspector can't read, such as Logical Volume Manager (LVM). + +For definitions of the advisory status values and details about advisory sources, see Supported operating systems. + +Supported operating systems for machine image scanning Operating system | Version | Advisory source | Advisory status +---|---|---|--- +AlmaLinux | 8 | CVE Errata | Fixed +AlmaLinux | 9 | CVE Errata | Fixed +AlmaLinux | 10 | CVE Errata | Fixed +Amazon Linux 2023 (AL2023) | AL2023 | CVE Errata | Fixed +Bottlerocket | 1.7.0 and later | CVE Errata | Fixed +Debian Server (Bookworm) | 12 | DSA CVE | Fixed, Open +Debian Server (Trixie) | 13 | DSA CVE | Fixed, Open +Fedora | 43 | CVE Errata | Fixed +Fedora | 44 | CVE Errata | Fixed +Oracle Linux | 8 | CVE Errata | Fixed +Oracle Linux | 9 | CVE Errata | Fixed +Oracle Linux | 10 | CVE Errata | Fixed +Red Hat Enterprise Linux (RHEL) | 8 | RHEL VEX CVE | Fixed +Red Hat Enterprise Linux (RHEL) | 9 | RHEL VEX CVE | Fixed +Red Hat Enterprise Linux (RHEL) | 10 | RHEL VEX CVE | Fixed +Rocky Linux | 8 | CVE Errata | Fixed +Rocky Linux | 9 | CVE Errata | Fixed +Rocky Linux | 10 | CVE Errata | Fixed +SUSE Linux Enterprise Server (SLES) | 15.7 | CVE Errata | Fixed +SUSE Linux Enterprise Server (SLES) | 16.0 | CVE Errata | Fixed +Ubuntu (Bionic) | 18.04 | USN | Fixed, Active, Pending +Ubuntu (Focal) | 20.04 | USN | Fixed, Active, Pending +Ubuntu (Jammy) | 22.04 | USN | Fixed, Active, Pending +Ubuntu (Noble) | 24.04 | USN | Fixed, Active, Pending +Ubuntu (Resolute) | 26.04 | USN | Fixed, Active, Pending +Windows Server | 2016 | MSKB | Fixed +Windows Server | 2019 | MSKB | Fixed +Windows Server | 2022 | MSKB | Fixed +Windows Server | 2025 | MSKB | Fixed +