Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Scanning machine images with Amazon Inspector

Amazon Inspector scans the machine images that your account owns for operating system and programming language package vulnerabilities. A machine image is an Amazon Machine Image (AMI) that you use to launch EC2 instances. When Amazon Inspector detects a vulnerability in a machine image, it produces a Package Vulnerability type finding with a Resource type of MACHINE_IMAGE. Scanning your machine images lets you find and remediate vulnerabilities before you use an image to launch instances.

For each machine image, Amazon Inspector collects a software inventory from all of the Amazon EBS snapshots that back the image, and then evaluates that inventory against vulnerability data that Amazon Inspector sources from more than 50 data feeds. Because Amazon Inspector reads the snapshots that back an image, you don't need to launch an instance from a machine image for Amazon Inspector to scan it.

By default, machine image scanning is continuous. When you activate machine image scanning for an account, Amazon Inspector discovers the machine images that your account owns, scans all of the eligible ones, and then keeps monitoring them for as long as they remain in scope. Amazon Inspector scans new machine images as you create, copy, register, or enable them, and rescans in-scope images whenever Amazon Inspector adds a new common vulnerabilities and exposures (CVE) item to its database that's relevant to that image. You don't need to request a rescan.

Exclusion mode, which scans all eligible machine images except the ones you tag for exclusion, is the default scan mode. If you only want Amazon Inspector to scan a targeted subset of your machine images, you can change the scan mode to inclusion mode and tag the images you want scanned. Amazon Inspector scans continuously in either mode; the scan mode controls which images are in scope, not how often Amazon Inspector scans them. For more information, see Managing machine image scan mode.

If you don't want continuous scanning, you can scan a single machine image on demand instead. An on-demand scan is a one-time scan that you request for a specific machine image, and it doesn't require you to activate Amazon Inspector. On-demand scans ignore your machine image scan configuration, and Amazon Inspector delivers the results only through Amazon EventBridge. For more information, see Running on-demand machine image scans with Amazon Inspector.

For information about how to activate machine image scanning, see Activating a scan type. For information about how to control which machine images Amazon Inspector scans, see Configuring machine image scanning. For information about how to view findings, see Viewing Amazon Inspector findings.

Eligible machine images

Amazon Inspector scans a machine image if the image meets all of the following conditions:

Scan behaviors for machine image scanning

When you first activate machine image scanning, Amazon Inspector discovers the machine images that your account owns and scans the images that are within your scan eligibility windows. Amazon Inspector then continues to monitor each in-scope image.

Amazon Inspector initiates a new scan of a machine image in the following situations:

Amazon Inspector keeps your scanning scope current by monitoring Amazon EC2 machine image lifecycle events. The following table describes how Amazon Inspector responds to each event.

You can check when Amazon Inspector last scanned a machine image for vulnerabilities from the Machine images tab on the Account management page, or by using the ListCoverage API operation.

Scan status values for machine images

The following table lists the scan status values that Amazon Inspector reports for a machine image.