AWS inspector: Document AWSServiceRoleForAmazonInspector2Ami service-linked role
Summary
Adds sections for creating, editing, and deleting the machine image scanning service-linked role (AWSServiceRoleForAmazonInspector2Ami), including that it is auto-created on enablement or first StartOnDemandScan call, that iam:CreateServiceLinkedRole is required, and that deletion is blocked while scans are in progress or enabled in any Region.
Security assessment
The added content documents an IAM service-linked role and the iam:CreateServiceLinkedRole permission required to trigger its creation, plus lifecycle/deletion constraints. This is IAM privilege and role-lifecycle guidance rather than a fix for a specific vulnerability, so it is security documentation of medium impact.
Evidence
+Amazon Inspector also creates this role automatically the first time you call the [StartOnDemandScan](https://docs.aws.amazon.com/inspector/v2/APIReference/API_StartOnDemandScan.html) API operation for a machine image, even if you haven't enabled machine image scanning for the account. To call StartOnDemandScan, the IAM identity must have permission for the `iam:CreateServiceLinkedRole` action. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html).
Diff
diff --git a/inspector/latest/user/using-service-linked-roles.md b/inspector/latest/user/using-service-linked-roles.md index 5ba8a0e..78eefaf 100644 --- a//inspector/latest/user/using-service-linked-roles.md +++ b//inspector/latest/user/using-service-linked-roles.md @@ -7 +7 @@ -Creating a service-linked role for Amazon InspectorEditing a service-linked role for Amazon InspectorDeleting a service-linked role for Amazon InspectorCreating a service-linked role for agentless scanningEditing a service-linked role for agentless scanningDeleting a service-linked role for agentless scanningCreating a service-linked role for multi-cloud scanningEditing a service-linked role for multi-cloud scanningDeleting a service-linked role for multi-cloud scanning +Creating a service-linked role for Amazon InspectorEditing a service-linked role for Amazon InspectorDeleting a service-linked role for Amazon InspectorCreating a service-linked role for agentless scanningEditing a service-linked role for agentless scanningDeleting a service-linked role for agentless scanningCreating a service-linked role for machine image scanningEditing a service-linked role for machine image scanningDeleting a service-linked role for machine image scanningCreating a service-linked role for multi-cloud scanningEditing a service-linked role for multi-cloud scanningDeleting a service-linked role for multi-cloud scanning @@ -58,0 +59,26 @@ Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleFor +## Creating a service-linked role for machine image scanning + +You don't need to manually create the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. When you enable machine image scanning in Amazon Inspector, Amazon Inspector automatically creates the service-linked role for you. + +Amazon Inspector also creates this role automatically the first time you call the [StartOnDemandScan](https://docs.aws.amazon.com/inspector/v2/APIReference/API_StartOnDemandScan.html) API operation for a machine image, even if you haven't enabled machine image scanning for the account. To call StartOnDemandScan, the IAM identity must have permission for the `iam:CreateServiceLinkedRole` action. For more information, see [Running on-demand machine image scans with Amazon Inspector](./machine-image-on-demand.html). + +## Editing a service-linked role for machine image scanning + +Amazon Inspector does not allow you to edit the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. After a service-linked role is created, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role by using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. + +## Deleting a service-linked role for machine image scanning + +If you no longer need to use machine image scanning, we recommend that you delete the `AWSServiceRoleForAmazonInspector2Ami` service-linked role. That way you don't have an unused entity that isn't actively monitored or maintained. + +###### Important + +In order to delete the `AWSServiceRoleForAmazonInspector2Ami` role, you must first disable machine image scanning in all Regions where it is enabled. + +###### Important + +Amazon Inspector also blocks deletion of the `AWSServiceRoleForAmazonInspector2Ami` role while an on-demand machine image scan is in progress in any AWS Region, so that the scan can finish. If you attempt to delete the role while a scan is in progress, the deletion fails. Wait for your on-demand scans to reach a terminal state, and then try the deletion again. To check whether a scan is still running, use the [GetOnDemandScanStatus](https://docs.aws.amazon.com/inspector/v2/APIReference/API_GetOnDemandScanStatus.html) API operation. + +**To manually delete the service-linked role using IAM** + +Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForAmazonInspector2Ami service-linked role. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the _IAM User Guide_. +