JA EN
shiichan

Scan EC2 AMIs for Vulnerabilities Without Launching Them, Now in Amazon Inspector!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi, it's Shii-chan! You can now check AMIs for vulnerabilities before you use them. That's reassuring!

AWS What's New aws.amazon.com

What was announced?

In AWS What's New, AWS announced that Amazon Inspector now extends vulnerability scanning to EC2 Amazon Machine Images (AMIs). You can find software vulnerabilities in your AMIs without launching instances or installing additional software.

The story so far

The announcement doesn't describe the previous approach in detail. The pitch this time is that you can fix issues at the source, before AMIs are used to launch instances across your fleet.

What changes

There are two ways to scan:

  • Continuous evaluation: monitor your AMI catalog for newly discovered vulnerabilities
  • One-time scans: target specific AMIs directly from the EC2 console

Catching issues earlier in the deployment pipeline reduces the risk of deploying compromised compute resources. Security teams can also set up a consistent scanning process across all AMIs.

Dive Deep

Here are the enablement and integration details.

  • You can enable AMI scanning for an account or across your entire organization in Amazon Inspector
  • For AWS Security Hub customers, you can enable it as an add-on across your organization, and findings are delivered to Security Hub too
  • Based on results, you can enable the Allowed AMIs setting and specify the security criteria AMIs must meet, enforced organization-wide with Declarative Policies
  • If you build AMIs with EC2 Image Builder, you can integrate scanning into your pipelines and restrict distribution of AMIs that don't meet your standards

It's available in all commercial AWS Regions where Amazon Inspector is available. Check the Amazon Inspector pricing page for costs.

Wrap-up

  • Scan AMIs for vulnerabilities without launching them or installing extra software
  • Supports both continuous evaluation and one-time scans
  • Works with Security Hub, Allowed AMIs, Declarative Policies, and Image Builder
  • Enable it per account or across an organization

This is for platform teams that distribute golden AMIs and for security owners!

Related posts