Class: Aws::Imagebuilder::Types::ImageScanningConfiguration

Inherits:

Struct

• Object
• Struct
• Aws::Imagebuilder::Types::ImageScanningConfiguration

Defined in:

gems/aws-sdk-imagebuilder/lib/aws-sdk-imagebuilder/types.rb

Overview

Contains settings for Image Builder image resource and container image scans.

See Also:

• AWS API Documentation

Constant Summary

SENSITIVE =

[]

Instance Attribute Summary

• #ecr_configuration ⇒ Types::EcrConfiguration

  Contains Amazon ECR settings for vulnerability scans.

• #image_scanning_enabled ⇒ Boolean

  Specifies whether Amazon Inspector scans for vulnerabilities when you create a new image.

• #image_scanning_types ⇒ Array<String>

  The type of vulnerability scan that Image Builder runs for AMI output when imageScanningEnabled is true.

• #scan_result_condition ⇒ Types::ScanResultCondition

  The condition that the output AMI's scan results must meet for the image to pass.

Instance Attribute Details

#ecr_configuration ⇒ Types::EcrConfiguration

Contains Amazon ECR settings for vulnerability scans.

Returns:

• (Types::EcrConfiguration)

# File 'gems/aws-sdk-imagebuilder/lib/aws-sdk-imagebuilder/types.rb', line 5063

class ImageScanningConfiguration < Struct.new(
  :image_scanning_enabled,
  :ecr_configuration,
  :image_scanning_types,
  :scan_result_condition)
  SENSITIVE = []
  include Aws::Structure
end

#image_scanning_enabled ⇒ Boolean

Specifies whether Amazon Inspector scans for vulnerabilities when you create a new image. You must also enable image tests. For AMI output, imageScanningTypes sets whether Amazon Inspector scans the test instance or the output AMI. For container output, Amazon Inspector scans the container image that Image Builder pushes to the Amazon ECR repository from your ecrConfiguration settings.

To use container image scans, you must activate Amazon Inspector for Amazon ECR scanning in the account and Amazon Web Services Region where the build runs. Amazon Inspector activation is Regional. The Image Builder ListImageScanFindings operation returns the findings of these scans.

Returns:

• (Boolean)

# File 'gems/aws-sdk-imagebuilder/lib/aws-sdk-imagebuilder/types.rb', line 5063

class ImageScanningConfiguration < Struct.new(
  :image_scanning_enabled,
  :ecr_configuration,
  :image_scanning_types,
  :scan_result_condition)
  SENSITIVE = []
  include Aws::Structure
end

#image_scanning_types ⇒ Array<String>

The type of vulnerability scan that Image Builder runs for AMI output when imageScanningEnabled is true. Specify a single value. If you omit imageScanningTypes, Image Builder uses TEST_INSTANCE_CVE. The scan types work as follows:

• With TEST_INSTANCE_CVE, Amazon Inspector scans the test instance during image tests. To use this scan, you must activate Amazon Inspector for Amazon EC2 scanning in the account and Amazon Web Services Region where the build runs. The Image Builder ListImageScanFindings operation returns the findings.

• With ON_DEMAND_AMI_CVE, Amazon Inspector starts an on-demand scan of the output AMI during image tests. To use this scan, you must build from an image recipe, but you do not need to activate Amazon Inspector in your account. The Amazon EC2 GetImageFindings operation returns the findings.

Returns:

• (Array<String>)

# File 'gems/aws-sdk-imagebuilder/lib/aws-sdk-imagebuilder/types.rb', line 5063

class ImageScanningConfiguration < Struct.new(
  :image_scanning_enabled,
  :ecr_configuration,
  :image_scanning_types,
  :scan_result_condition)
  SENSITIVE = []
  include Aws::Structure
end

#scan_result_condition ⇒ Types::ScanResultCondition

The condition that the output AMI's scan results must meet for the image to pass. You can set scanResultCondition only when imageScanningTypes is ON_DEMAND_AMI_CVE. If you omit it, Image Builder starts the scan but does not wait for it or use its results to pass or fail the image.

When you set scanResultCondition, the test phase waits for the scan to finish. Then Image Builder checks the findings against the condition. By default, Image Builder counts only findings that have a fix available. To count every finding, set fixAvailable to false. If a counted finding exceeds maximumSeverityLabel, Image Builder fails the image in the test phase and does not distribute the AMI.

Returns:

• (Types::ScanResultCondition)

# File 'gems/aws-sdk-imagebuilder/lib/aws-sdk-imagebuilder/types.rb', line 5063

class ImageScanningConfiguration < Struct.new(
  :image_scanning_enabled,
  :ecr_configuration,
  :image_scanning_types,
  :scan_result_condition)
  SENSITIVE = []
  include Aws::Structure
end