On 2 November 2026, AWS announced that EC2 Amazon Machine Images can now be scanned for vulnerabilities through Amazon Inspector. Until now, Inspector looked at running EC2 instances, ECR container images and Lambda functions. A vulnerable package baked into a golden AMI only showed up after you had already launched instances from it, sometimes across your whole fleet.
Amazon Inspector AMI scanning closes that gap. Inspector reads the EBS snapshots behind an image, so you can find CVEs without launching an instance or installing an agent. This guide covers how it works, how to set it up, and how to stop vulnerable images from being launched.
What Is Amazon Inspector AMI Scanning?
According to the Amazon Inspector User Guide, Inspector collects a software inventory from every EBS snapshot that backs an AMI. It then checks that inventory against vulnerability data from more than 50 data feeds. It covers both operating system packages and programming language packages. Each issue it finds becomes a Package Vulnerability finding with a resource type of MACHINE_IMAGE.
There are two ways to scan:
- Continuous scanning. You activate machine image scanning for an account or an entire organization. Inspector scans images when you create, copy, register or enable them. It also rescans in-scope images whenever it adds a relevant new CVE to its database, so you never have to request a rescan.
- On-demand scanning. This is a one-time scan of a single AMI, and it works without activating Inspector. It suits a build pipeline that has just produced a new image.
The EC2 console also shows the results. Each AMI has a Security tab with a scan summary and detailed findings, and the AMI list can display the highest severity for each image.
Why It Matters for Teams Using Golden AMIs
Teams running EC2, Auto Scaling groups or self-managed Kubernetes nodes often reuse hardened base images for months. Meanwhile, new CVEs are published against packages that were clean on build day. Continuous AMI scanning catches those, so you fix the image once at the source instead of patching every instance launched from it.
Results also travel with the image. Per the Amazon EC2 User Guide, when you share a scanned AMI with other accounts or OUs, they can see its scan results too. Your application teams can check an image’s security status before they use it.
How to Set Up Amazon Inspector AMI Scanning
1. Check that your images are eligible
Inspector only scans AMIs that your account owns, including the snapshots behind them. Images must be EBS-backed, in the available state, run a single supported operating system, and use ext3, ext4, NTFS or XFS file systems. Logical Volume Manager (LVM) is not supported. An image that uses it is reported as UNSUPPORTED_OS. To scan a shared or public AMI, copy it into your account first. One more catch: if a KMS key policy blocks Inspector from reading encrypted snapshots, the scan status becomes ACCESS_DENIED.
2. Run a quick on-demand scan
To try it on one image, select the AMI in the EC2 console and start an on-demand scan from the Security options in the Actions menu, or use the CLI:
aws inspector2 start-on-demand-scan \
--resource-id ami-0abcdef1234567890 \
--resource-type AMIThe on-demand scan documentation lists the IAM permissions you need: inspector2:StartOnDemandScan and iam:CreateServiceLinkedRole. You can run one scan per image at a time, and up to 20 on-demand scans at once. Note that on-demand findings go only to Amazon EventBridge and the EC2 console. They do not appear in the Inspector console or Security Hub CSPM. To act on them automatically, create an EventBridge rule for the Inspector2 OnDemand Scan Complete and Inspector2 OnDemand Finding events.
3. Read the results from the CLI
aws ec2 describe-images --image-ids ami-0abcdef1234567890 \
--query "Images[].ScanResults"
aws ec2 get-image-findings --image-id ami-0abcdef1234567890
aws ec2 describe-images \
--filters "Name=scan-result.highest-finding-severity-label,Values=critical" \
--query "Images[].ImageId"The last command lists every AMI with a critical finding, a quick way to triage a large catalog.
4. Turn on continuous scanning and tune the scope
For continuous coverage, activate machine image scanning in Inspector, then adjust the settings under General settings. The scan configuration guide explains the defaults:
- Eligibility windows: an image is in scope if it was created, or used to launch an instance, within the last 14 days. You can choose from 7 to 180 days.
- Exclusions: copied AMIs and backup AMIs created by AWS Backup or Data Lifecycle Manager are excluded by default.
- Scan mode: exclusion mode (
SCAN_ALL) scans everything except the images you tag. Inclusion mode (TARGET_SCANNING) scans only the images you tag, such as production golden images.
Tag your images before switching to inclusion mode. When you switch, Inspector immediately drops every untagged image from scope and closes its findings. Longer windows mean more images get scanned, so they also cost more.
5. Gate launches with Allowed AMIs
Scanning only helps if someone acts on the results. The Allowed AMIs setting now supports a ScanResultCondition. For example, you can allow only images that Inspector scanned in the last 30 days and whose highest severity is medium or lower:
"ScanResultCondition": {
"MaximumSeverityLabel": "medium",
"MaxDaysSinceLastFindingScan": 30
}Allowed AMIs applies only to public AMIs and AMIs shared with your account. It never restricts images your own account created. That makes it a good fit for a central image account that shares golden AMIs with workload accounts. Start in audit mode to see which images would be blocked, and roll it out across accounts with Declarative Policies in AWS Organizations.
6. Block bad images in EC2 Image Builder
If you build images with EC2 Image Builder, set the scan type to ON_DEMAND_AMI_CVE and add a scanResultCondition. According to the Image Builder documentation, the image fails in the test stage and is not distributed if the output AMI has findings above your maximumSeverityLabel. A counted critical finding always fails the build.
What Does It Cost?
The Amazon Inspector pricing page uses US East (N. Virginia) examples. Continuous evaluation is $1.2528 per AMI per month, prorated by hours scanned, and a one-time scan is $0.42 per AMI. So 50 golden AMIs under continuous evaluation cost about $62.64 a month. Continuous AMI scanning is included in the 15-day free trial for accounts new to Inspector. On-demand AMI scans are not.
For a wider view of hardening your AWS accounts, see our AWS security services. If your image pipeline needs an overhaul, our cloud DevOps services team builds automated, scanned AMI pipelines.
FAQ
Do I need to launch an instance or install an agent to scan an AMI?
No. Amazon Inspector reads the EBS snapshots behind the AMI, so you don’t need to launch an instance or install the SSM agent.
Can Inspector scan public or AWS Marketplace AMIs?
Not directly. Inspector only scans AMIs your account owns. Copy the image into your account, then scan the copy.
Why don’t my on-demand scan findings appear in the Inspector console?
By design, on-demand findings are delivered only through EventBridge and shown in the EC2 console. Findings from continuous scanning appear in the Inspector console and Security Hub CSPM.
Is Amazon Inspector AMI scanning available in every Region?
It is available in all commercial AWS Regions where Amazon Inspector is available. It is not available in the AWS GovCloud (US) or China Regions.
Start Scanning Your Golden Images Before They Ship
Shanav Technologies helps startups and growing businesses secure their AWS workloads, from image pipelines to organization-wide guardrails. If you want a scanned, policy-gated AMI workflow without slowing down your releases, talk to our team and we will help you roll out Amazon Inspector AMI scanning across your accounts.