View a markdown version of this page

Service-linked role permissions for Amazon Inspector machine image scans - Amazon Inspector
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Service-linked role permissions for Amazon Inspector machine image scans

Amazon Inspector machine image scanning uses the service-linked role named AWSServiceRoleForAmazonInspector2Ami. This SLR allows Amazon Inspector to read the data from the existing Amazon EBS snapshots that back the machine images that your account owns. Unlike agentless Amazon EC2 scanning, machine image scanning doesn't create new snapshots. This service-linked role trusts the ami.inspector2.amazonaws.com service to assume the role.

The permissions policy for the role, which is named AmazonInspector2AmiServiceRolePolicy, allows Amazon Inspector to perform tasks such as:

  • Use Amazon Elastic Compute Cloud (Amazon EC2) actions to retrieve information about the machine images that your account owns and the snapshots that back them.

  • Use Amazon EBS actions to read the contents of the snapshots that back your machine images.

  • Use select Amazon KMS decryption actions to decrypt snapshots encrypted with Amazon KMS customer managed keys.

Amazon Inspector doesn't use this role to scan machine images that you have excluded from scans. For more information, see Excluding copied and backup machine images.

For the permissions in this policy, see AmazonInspector2AmiServiceRolePolicy in the Amazon Managed Policy Reference Guide.