EC2 Amazon Machine Images can now be scanned for vulnerabilities through Amazon Inspector
Amazon Inspector now scans EC2 AMIs for vulnerabilities before instances launch, enabling earlier remediation and enforcing security policies across accounts and organizations.
Amazon Inspector has expanded its vulnerability scanning capabilities to include EC2 Amazon Machine Images (AMIs), allowing users to detect software vulnerabilities without launching instances or installing additional tools. This feature enables proactive identification of issues at the source, reducing exposure before AMIs are deployed across environments. Scans can be run continuously to monitor AMIs for new vulnerabilities or as one-time targeted assessments directly from the EC2 Console.
Organizations can enable AMI scanning at the account or organizational level within Amazon Inspector, with findings automatically delivered to AWS Security Hub for centralized management. Security Hub customers can activate AMI scanning as an add-on across their organization, ensuring consistent visibility into vulnerability data across all accounts.
Based on scan results, users can enforce security policies by enabling the Allowed AMIs setting, which restricts AMI usage to those meeting specified security criteria. This enforcement can be applied across the entire organization using Declarative Policies, ensuring compliance before instances are launched.
The new AMI scanning capability is available in all commercial AWS Regions where Amazon Inspector is offered. Customers using EC2 Image Builder can integrate scanning into their pipelines, blocking distribution of AMIs that fail security checks to maintain deployment standards.