Skip to main content

🛡️ AWS Inspector EC2 Scanning is not enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS accounts where Amazon EC2 scanning is not enabled.

Amazon Inspector is a vulnerability discovery service that automates continuous security assessments for Amazon EC2 instances. It helps identify software vulnerabilities (CVEs) and unintended network exposure, enabling organizations to proactively manage security risks.

Rationale​

Enabling Amazon Inspector for EC2 provides the following benefits:

  1. Automated Discovery: Automatically detects newly launched EC2 instances and initiates vulnerability scans without manual intervention.
  2. Near Real-Time Intelligence: Triggers scans based on environmental changes, such as new software installations or newly disclosed CVEs.
  3. Risk-Based Prioritization: Delivers contextual risk scores by correlating vulnerability data with factors such as network exposure and instance configuration.

Audit​

This policy flags an AWS Account as INCOMPLIANT if Inspector: EC2 Status or Inspector: Status is not set to Enabled for the Account.

Remediation​

Open File

Remediation​

Enable Amazon Inspector EC2 Scanning​

If you are the delegated administrator for an AWS Organization, you can enable Amazon Inspector scan types across multiple accounts and Regions using the AWS CLI and automation scripts. For additional guidance, refer to the inspector2-enablement-with-cli repository on GitHub.

From Console​

To activate Amazon Inspector EC2 scanning:

  1. Open the Amazon Inspector console: https://console.aws.amazon.com/inspector/v2/home

  2. Using the AWS Region selector in the upper-right corner, select the Region in which you want to enable EC2 scanning.

  3. In the navigation pane, choose Account management.

  4. Select the account(s) for which you want to enable a scan type.

  5. Choose Activate, then select EC2 scanning.

  6. Repeat these steps for each AWS Region where EC2 instances are deployed to ensure comprehensive coverage.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Inspector.1] Amazon Inspector EC2 scanning should be enabled1no data
💼 Cloudaware Framework → 💼 Threat Protection48no data
💼 PCI DSS v3.2.1 → 💼 11.2.1 Perform quarterly internal vulnerability scans. Address vulnerabilities and perform rescans to verify all “high risk” vulnerabilities are resolved in accordance with the entity's vulnerability ranking.2no data
💼 PCI DSS v4.0.1 → 💼 11.3.1 Internal vulnerability scans are performed.32no data
💼 PCI DSS v4.0 → 💼 11.3.1 Internal vulnerability scans are performed.32no data