Service-linked role permissions for Amazon Inspector - Amazon Inspector
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Service-linked role permissions for Amazon Inspector

Amazon Inspector uses the service-linked role named AWSServiceRoleForAmazonInspector2. This service-linked role trusts the inspector2.amazonaws.com service to assume the role.

The permissions policy for the role, which is named AmazonInspector2ServiceRolePolicy, allows Amazon Inspector to perform tasks such as:

  • Use Amazon Elastic Compute Cloud (Amazon EC2) actions to retrieve information about your instances and network paths.

  • Use Amazon Systems Manager actions to retrieve inventory from your Amazon EC2 instances, and to retrieve information about third-party packages from custom paths.

  • Use the Amazon Systems Manager SendCommand action to invoke CIS scans for target instances.

  • Use Amazon Elastic Container Registry actions to retrieve information about your container images.

  • Use Amazon Lambda actions to retrieve information about your Lambda functions.

  • Use Amazon Organizations actions to describe associated accounts.

  • Use CloudWatch actions to retrieve information about the last time your Lambda functions were invoked.

  • Use select IAM actions to retrieve information about your IAM policies that could create security vulnerabilities in your Lambda code.

  • Use CodeGuru Security actions to perform scans of the code in your Lambda functions. Amazon Inspector uses the following CodeGuru Security actions:

    • codeguru-security:CreateScan – Grants permission to create CodeGuru Security scan.

    • codeguru-security:GetScan – Grants permission to retrieve CodeGuru Security scan metadata.

    • codeguru-security:ListFindings – Grants permission to retrieve findings generated by CodeGuru Security.

    • codeguru-security:DeleteScansByCategory – Grants permission for CodeGuru Security to delete scans initiated by Amazon Inspector.

    • codeguru-security:BatchGetFindings – Grants permission to retrieve a batch of specific findings generated by CodeGuru Security.

  • Use select Elastic Load Balancing actions to preform network scans of EC2 instances that are part of Elastic Load Balancing target groups.

The role is configured with the following permissions policy.


     {
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "TirosPolicy",
			"Effect": "Allow",
			"Action": [
				"directconnect:DescribeConnections",
				"directconnect:DescribeDirectConnectGatewayAssociations",
				"directconnect:DescribeDirectConnectGatewayAttachments",
				"directconnect:DescribeDirectConnectGateways",
				"directconnect:DescribeVirtualGateways",
				"directconnect:DescribeVirtualInterfaces",
				"ec2:DescribeAvailabilityZones",
				"ec2:DescribeCustomerGateways",
				"ec2:DescribeInstances",
				"ec2:DescribeInternetGateways",
				"ec2:DescribeManagedPrefixLists",
				"ec2:DescribeNatGateways",
				"ec2:DescribeNetworkAcls",
				"ec2:DescribeNetworkInterfaces",
				"ec2:DescribePrefixLists",
				"ec2:DescribeRegions",
				"ec2:DescribeRouteTables",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeSubnets",
				"ec2:DescribeTransitGatewayAttachments",
				"ec2:DescribeTransitGatewayConnects",
				"ec2:DescribeTransitGatewayPeeringAttachments",
				"ec2:DescribeTransitGatewayRouteTables",
				"ec2:DescribeTransitGatewayVpcAttachments",
				"ec2:DescribeTransitGateways",
				"ec2:DescribeVpcEndpointServiceConfigurations",
				"ec2:DescribeVpcEndpoints",
				"ec2:DescribeVpcPeeringConnections",
				"ec2:DescribeVpcs",
				"ec2:DescribeVpnConnections",
				"ec2:DescribeVpnGateways",
				"ec2:GetManagedPrefixListEntries",
				"ec2:GetTransitGatewayRouteTablePropagations",
				"ec2:SearchTransitGatewayRoutes",
				"elasticloadbalancing:DescribeListeners",
				"elasticloadbalancing:DescribeLoadBalancerAttributes",
				"elasticloadbalancing:DescribeLoadBalancers",
				"elasticloadbalancing:DescribeRules",
				"elasticloadbalancing:DescribeTags",
				"elasticloadbalancing:DescribeTargetGroups",
				"elasticloadbalancing:DescribeTargetGroupAttributes",
				"elasticloadbalancing:DescribeTargetHealth",
				"network-firewall:DescribeFirewall",
				"network-firewall:DescribeFirewallPolicy",
				"network-firewall:DescribeResourcePolicy",
				"network-firewall:DescribeRuleGroup",
				"network-firewall:ListFirewallPolicies",
				"network-firewall:ListFirewalls",
				"network-firewall:ListRuleGroups",
				"tiros:CreateQuery",
				"tiros:GetQueryAnswer"
			],
			"Resource": [
				"*"
			]
		},
		{
			"Sid": "PackageVulnerabilityScanning",
			"Effect": "Allow",
			"Action": [
				"ecr:BatchGetImage",
				"ecr:BatchGetRepositoryScanningConfiguration",
				"ecr:DescribeImages",
				"ecr:DescribeRegistry",
				"ecr:DescribeRepositories",
				"ecr:GetAuthorizationToken",
				"ecr:GetDownloadUrlForLayer",
				"ecr:GetRegistryScanningConfiguration",
				"ecr:ListImages",
				"ecr:PutRegistryScanningConfiguration",
				"organizations:DescribeAccount",
				"organizations:DescribeOrganization",
				"organizations:ListAccounts",
				"ssm:DescribeAssociation",
				"ssm:DescribeAssociationExecutions",
				"ssm:DescribeInstanceInformation",
				"ssm:ListAssociations",
				"ssm:ListResourceDataSync"
			],
			"Resource": "*"
		},
		{
			"Sid": "LambdaPackageVulnerabilityScanning",
			"Effect": "Allow",
			"Action": [
				"lambda:ListFunctions",
				"lambda:GetFunction",
				"lambda:GetLayerVersion",
				"lambda:ListTags",
				"cloudwatch:GetMetricData"
			],
			"Resource": "*"
		},
		{
			"Sid": "GatherInventory",
			"Effect": "Allow",
			"Action": [
				"ssm:CreateAssociation",
				"ssm:StartAssociationsOnce",
				"ssm:DeleteAssociation",
				"ssm:UpdateAssociation"
			],
			"Resource": [
				"arn:aws:ec2:*:*:instance/*",
				"arn:aws:ssm:*:*:document/AmazonInspector2-*",
				"arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory",
				"arn:aws:ssm:*:*:managed-instance/*",
				"arn:aws:ssm:*:*:association/*"
			]
		},
		{
			"Sid": "DataSyncCleanup",
			"Effect": "Allow",
			"Action": [
				"ssm:CreateResourceDataSync",
				"ssm:DeleteResourceDataSync"
			],
			"Resource": [
				"arn:aws:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete"
			]
		},
		{
			"Sid": "ManagedRules",
			"Effect": "Allow",
			"Action": [
				"events:PutRule",
				"events:DeleteRule",
				"events:DescribeRule",
				"events:ListTargetsByRule",
				"events:PutTargets",
				"events:RemoveTargets"
			],
			"Resource": [
				"arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule"
			]
		},
		{
			"Sid": "LambdaCodeVulnerabilityScanning",
			"Effect": "Allow",
			"Action": [
				"codeguru-security:CreateScan",
				"codeguru-security:GetAccountConfiguration",
				"codeguru-security:GetFindings",
				"codeguru-security:GetScan",
				"codeguru-security:ListFindings",
				"codeguru-security:BatchGetFindings",
				"codeguru-security:DeleteScansByCategory"
			],
			"Resource": [
				"*"
			]
		},
		{
			"Sid": "CodeGuruCodeVulnerabilityScanning",
			"Effect": "Allow",
			"Action": [
				"iam:GetRole",
				"iam:GetRolePolicy",
				"iam:GetPolicy",
				"iam:GetPolicyVersion",
				"iam:ListAttachedRolePolicies",
				"iam:ListPolicies",
				"iam:ListPolicyVersions",
				"iam:ListRolePolicies",
				"lambda:ListVersionsByFunction"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"ForAnyValue:StringEquals": {
					"aws:CalledVia": [
						"codeguru-security.amazonaws.com"
					]
				}
			}
		},
		{
			"Sid": "Ec2DeepInspection",
			"Effect": "Allow",
			"Action": [
				"ssm:PutParameter",
				"ssm:GetParameters",
				"ssm:DeleteParameter"
			],
			"Resource": [
				"arn:aws:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "AllowManagementOfServiceLinkedChannel",
			"Effect": "Allow",
			"Action": [
				"cloudtrail:CreateServiceLinkedChannel",
				"cloudtrail:DeleteServiceLinkedChannel"
			],
			"Resource": [
				"arn:aws:cloudtrail:*:*:channel/aws-service-channel/inspector2/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "AllowListServiceLinkedChannels",
			"Effect": "Allow",
			"Action": [
				"cloudtrail:ListServiceLinkedChannels"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "AllowToRunInvokeCisSpecificDocuments",
			"Effect": "Allow",
			"Action": [
				"ssm:SendCommand",
				"ssm:GetCommandInvocation"
			],
			"Resource": [
				"arn:aws:ssm:*:*:document/AmazonInspector2-InvokeInspectorSsmPluginCIS"
			]
		},
		{
			"Sid": "AllowToRunCisCommandsToSpecificResources",
			"Effect": "Allow",
			"Action": [
				"ssm:SendCommand"
			],
			"Resource": [
				"arn:aws:ec2:*:*:instance/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "AllowToPutCloudwatchMetricData",
			"Effect": "Allow",
			"Action": [
				"cloudwatch:PutMetricData"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"StringEquals": {
					"cloudwatch:namespace": "AWS/Inspector2"
				}
			}
		}
	]
}