使用 AWS CLI 的 Amazon Inspector 示例

为调查发现添加属性

以下 add-attribute-to-finding 命令将键为 Example 且值为 example 的属性分配给 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-8l1VIE0D/run/0-Z02cjjug/finding/0-T8yM9mEU 的调查发现：

aws inspector add-attributes-to-findings --finding-arns arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-8l1VIE0D/run/0-Z02cjjug/finding/0-T8yM9mEU --attributes key=Example,value=example

输出：

{
    "failedItems": {}
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 调查发现”。

示例：将 AWS 账户与 Amazon Inspector 委托管理员关联

以下 associate-member 示例将 AWS 账户与 Amazon Inspector 委托管理员关联。

aws inspector2 associate-member \
    --account-id 123456789012

输出：

{
    "accountId": "123456789012"
}

有关更多信息，请参阅《Amazon Inspector User Guide》中的 Managing multiple accounts in Amazon Inspector with AWS Organizations。

创建评估目标

以下 create-assessment-target 命令使用 ARN 为 arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-AB6DMKnv 的资源组创建名为 ExampleAssessmentTarget 的评估目标：

aws inspector create-assessment-target --assessment-target-name ExampleAssessmentTarget --resource-group-arn arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-AB6DMKnv

输出：

{
    "assessmentTargetArn": "arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX"
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估目标”。

创建评估模板

以下 create-assessment-template 命令为 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX 的评估目标创建名为 ExampleAssessmentTemplate 的评估模板：

aws inspector create-assessment-template --assessment-target-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX --assessment-template-name ExampleAssessmentTemplate --duration-in-seconds 180 --rules-package-arns arn:aws:inspector:us-west-2:758058086616:rulespackage/0-9hgA516p --user-attributes-for-findings key=ExampleTag,value=examplevalue

输出：

{
    "assessmentTemplateArn": "arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T"
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

创建筛选器

以下 create-filter 示例创建了一个忽略 ECR 实例类型调查发现的抑制规则。

aws inspector2 create-filter \
    --name "ExampleSuppressionRuleECR" \
    --description "This suppression rule omits ECR instance type findings" \
    --action SUPPRESS \
    --filter-criteria 'resourceType=[{comparison="EQUALS", value="AWS_ECR_INSTANCE"}]'

输出：

{
    "arn": "arn:aws:inspector2:us-west-2:123456789012:owner/o-EXAMPLE222/filter/EXAMPLE444444444"
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的筛选 Amazon Inspector 调查发现。

创建调查发现报告

以下 create-findings-report 示例创建了一个调查发现报告。

aws inspector2 create-findings-report \
    --report-format CSV \
    --s3-destination bucketName=inspector-sbom-123456789012,keyPrefix=sbom-key,kmsKeyArn=arn:aws:kms:us-west-2:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE33333 \
    --filter-criteria '{"ecrImageRepositoryName":[{"comparison":"EQUALS","value":"debian"}]}'

输出：

{
    "reportId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333"
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的在 Amazon Inspector 中管理调查发现。

创建资源组

以下 create-resource-group 命令使用标签键为 Name 以及值为 example 创建一个资源组：

aws inspector create-resource-group --resource-group-tags key=Name,value=example

输出：

{
   "resourceGroupArn": "arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-AB6DMKnv"
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估目标”。

创建软件物料清单（SBOM）报告

以下 create-sbom-export 示例创建了一个软件物料清单（SBOM）报告。

aws inspector2 create-sbom-export \
    --report-format SPDX_2_3 \
    --resource-filter-criteria 'ecrRepositoryName=[{comparison="EQUALS",value="debian"}]' \
    --s3-destination bucketName=inspector-sbom-123456789012,keyPrefix=sbom-key,kmsKeyArn=arn:aws:kms:us-west-2:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE33333

输出：

{
    "reportId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333"
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的使用 Amazon Inspector 导出 SBOM。

删除评估运行

以下 delete-assessment-run 命令删除 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T/run/0-11LMTAVe 的评估运行：

aws inspector delete-assessment-run --assessment-run-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T/run/0-11LMTAVe

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

删除评估目标

以下 delete-assessment-target 命令删除 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq 的评估目标：

aws inspector delete-assessment-target --assessment-target-arn arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估目标”。

删除评估模板

以下 delete-assessment-template 命令删除 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T 的评估模板：

aws inspector delete-assessment-template --assessment-template-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

删除筛选器

以下 delete-filter 示例删除一个筛选器。

aws inspector2 delete-filter \
    --arn "arn:aws:inspector2:us-west-2:123456789012:owner/o-EXAMPLE222/filter/EXAMPLE444444444"

输出：

{
    "arn": "arn:aws:inspector2:us-west-2:123456789012:owner/o-EXAMPLE222/filter/EXAMPLE444444444"
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的筛选 Amazon Inspector 调查发现。

描述评估运行

以下 describe-assessment-run 命令描述 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE 的评估运行：

aws inspector describe-assessment-runs --assessment-run-arns arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE

输出：

{
        "assessmentRuns": [
          {
                "arn": "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE",
                "assessmentTemplateArn": "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw",
                "completedAt": 1458680301.4,
                "createdAt": 1458680170.035,
                "dataCollected": true,
                "durationInSeconds": 3600,
                "name": "Run 1 for ExampleAssessmentTemplate",
                "notifications": [],
                "rulesPackageArns": [
                  "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-X1KXtawP"
                ],
                "startedAt": 1458680170.161,
                "state": "COMPLETED",
                "stateChangedAt": 1458680301.4,
                "stateChanges": [
                  {
                        "state": "CREATED",
                        "stateChangedAt": 1458680170.035
                  },
                  {
                        "state": "START_DATA_COLLECTION_PENDING",
                        "stateChangedAt": 1458680170.065
                  },
                  {
                        "state": "START_DATA_COLLECTION_IN_PROGRESS",
                        "stateChangedAt": 1458680170.096
                  },
                  {
                        "state": "COLLECTING_DATA",
                        "stateChangedAt": 1458680170.161
                  },
                  {
                        "state": "STOP_DATA_COLLECTION_PENDING",
                        "stateChangedAt": 1458680239.883
                  },
                  {
                        "state": "DATA_COLLECTED",
                        "stateChangedAt": 1458680299.847
                  },
                  {
                        "state": "EVALUATING_RULES",
                        "stateChangedAt": 1458680300.099
                  },
                  {
                        "state": "COMPLETED",
                        "stateChangedAt": 1458680301.4
                  }
                ],
                "userAttributesForFindings": []
          }
        ],
        "failedItems": {}
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

描述评估目标

以下 describe-assessment-targets 命令描述 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq 的评估目标：

aws inspector describe-assessment-targets --assessment-target-arns arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq

输出：

{
      "assessmentTargets": [
        {
              "arn": "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq",
              "createdAt": 1458074191.459,
              "name": "ExampleAssessmentTarget",
              "resourceGroupArn": "arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-PyGXopAI",
              "updatedAt": 1458074191.459
        }
      ],
      "failedItems": {}
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估目标”。

描述评估模板

以下 describe-assessment-templates 命令描述 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw 的评估模板：

aws inspector describe-assessment-templates --assessment-template-arns arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw

输出：

{
      "assessmentTemplates": [
        {
              "arn": "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw",
              "assessmentTargetArn": "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq",
              "createdAt": 1458074191.844,
              "durationInSeconds": 3600,
              "name": "ExampleAssessmentTemplate",
              "rulesPackageArns": [
                "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-X1KXtawP"
              ],
              "userAttributesForFindings": []
        }
      ],
      "failedItems": {}
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

描述跨账户访问角色

以下 describe-cross-account-access-role 命令描述使 Amazon Inspector 能够访问您的 AWS 账户的 IAM 角色：

aws inspector describe-cross-account-access-role

输出：

{
        "registeredAt": 1458069182.826,
        "roleArn": "arn:aws:iam::123456789012:role/inspector",
        "valid": true
}

有关更多信息，请参阅《Amazon Inspector》指南中的“设置 Amazon Inspector”。

描述调查发现

以下 describe-findings 命令描述 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE/finding/0-HwPnsDm4 的调查发现：

aws inspector describe-findings --finding-arns arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE/finding/0-HwPnsDm4

输出：

{
      "failedItems": {},
      "findings": [
        {
              "arn": "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE/finding/0-HwPnsDm4",
              "assetAttributes": {
                "ipv4Addresses": [],
                "schemaVersion": 1
              },
              "assetType": "ec2-instance",
              "attributes": [],
              "confidence": 10,
              "createdAt": 1458680301.37,
              "description": "Amazon Inspector did not find any potential security issues during this assessment.",
              "indicatorOfCompromise": false,
              "numericSeverity": 0,
              "recommendation": "No remediation needed.",
              "schemaVersion": 1,
              "service": "Inspector",
              "serviceAttributes": {
                "assessmentRunArn": "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE",
                "rulesPackageArn": "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-X1KXtawP",
                "schemaVersion": 1
              },
              "severity": "Informational",
              "title": "No potential security issues found",
              "updatedAt": 1458680301.37,
              "userAttributes": []
        }
      ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 调查发现”。

描述资源组

以下 describe-resource-groups 命令描述 ARN 为 arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-PyGXopAI 的资源组：

aws inspector describe-resource-groups --resource-group-arns arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-PyGXopAI

输出：

{
      "failedItems": {},
      "resourceGroups": [
        {
              "arn": "arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-PyGXopAI",
              "createdAt": 1458074191.098,
              "tags": [
                {
                      "key": "Name",
                      "value": "example"
                }
              ]
        }
      ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估目标”。

描述规则包

以下 describe-rules-packages 命令描述 ARN 为 arn:aws:inspector:us-west-2:758058086616:rulespackage/0-9hgA516p 的规则包：

aws inspector describe-rules-packages --rules-package-arns arn:aws:inspector:us-west-2:758058086616:rulespackage/0-9hgA516p

输出：

{
      "failedItems": {},
      "rulesPackages": [
        {
              "arn": "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-9hgA516p",
              "description": "The rules in this package help verify whether the EC2 instances in your application are exposed to Common Vulnerabilities and
              Exposures (CVEs). Attacks can exploit unpatched vulnerabilities to compromise the confidentiality, integrity, or availability of your service
              or data. The CVE system provides a reference for publicly known information security vulnerabilities and exposures. For more information, see
              [https://cve.mitre.org/](https://cve.mitre.org/). If a particular CVE appears in one of the produced Findings at the end of a completed
              Inspector assessment, you can search [https://cve.mitre.org/](https://cve.mitre.org/) using the CVE's ID (for example, \"CVE-2009-0021\") to
              find detailed information about this CVE, its severity, and how to mitigate it. ",
              "name": "Common Vulnerabilities and Exposures",
              "provider": "Amazon Web Services, Inc.",
              "version": "1.1"
        }
      ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 规则包和规则”。

示例：取消成员账户与 Amazon Inspector 委托管理员的关联

以下 disassociate-member 示例取消 AWS 账户与 Amazon Inspector 委托管理员的关联。

aws inspector2 disassociate-member \
    --account-id 123456789012

输出：

{
    "accountId": "123456789012"
}

有关更多信息，请参阅《Amazon Inspector User Guide》中的 Managing multiple accounts in Amazon Inspector with AWS Organizations。

获取 Inspector 扫描的设置配置

以下 get-configuration 示例获取 Inspector 扫描的设置配置。

aws inspector2 get-configuration

输出：

{
    "ec2Configuration": {
        "scanModeState": {
            "scanMode": "EC2_HYBRID",
            "scanModeStatus": "SUCCESS"
        }
    },
    "ecrConfiguration": {
        "rescanDurationState": {
            "pullDateRescanDuration": "DAYS_90",
            "rescanDuration": "DAYS_30",
            "status": "SUCCESS",
            "updatedAt": "2024-05-14T21:16:20.237000+00:00"
        }
     }
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的使用 Amazon Inspector 自动扫描资源。

示例：获取组织的成员信息

aws inspector2 get-member --account-id 123456789012

输出：

{
        "member": {
        "accountId": "123456789012",
        "delegatedAdminAccountId": "123456789012",
        "relationshipStatus": "ENABLED",
        "updatedAt": "2023-09-11T09:57:20.520000-07:00"
    }
}

有关更多信息，请参阅《Amazon Inspector User Guide》中的 Managing multiple accounts in Amazon Inspector with AWS Organizations。

获取遥测元数据

以下 get-telemetry-metadata 命令生成有关为 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE 的评估运行收集的数据的信息：

aws inspector get-telemetry-metadata --assessment-run-arn arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE

输出：

{
      "telemetryMetadata": [
        {
              "count": 2,
              "dataSize": 345,
              "messageType": "InspectorDuplicateProcess"
        },
        {
              "count": 3,
              "dataSize": 255,
              "messageType": "InspectorTimeEventMsg"
        },
        {
              "count": 4,
              "dataSize": 1082,
              "messageType": "InspectorNetworkInterface"
        },
        {
              "count": 2,
              "dataSize": 349,
              "messageType": "InspectorDnsEntry"
        },
        {
              "count": 11,
              "dataSize": 2514,
              "messageType": "InspectorDirectoryInfoMsg"
        },
        {
              "count": 1,
              "dataSize": 179,
              "messageType": "InspectorTcpV6ListeningPort"
        },
        {
              "count": 101,
              "dataSize": 10949,
              "messageType": "InspectorTerminal"
        },
        {
              "count": 26,
              "dataSize": 5916,
              "messageType": "InspectorUser"
        },
        {
              "count": 282,
              "dataSize": 32148,
              "messageType": "InspectorDynamicallyLoadedCodeModule"
        },
        {
              "count": 18,
              "dataSize": 10172,
              "messageType": "InspectorCreateProcess"
        },
        {
              "count": 3,
              "dataSize": 8001,
              "messageType": "InspectorProcessPerformance"
        },
        {
              "count": 1,
              "dataSize": 360,
              "messageType": "InspectorOperatingSystem"
        },
        {
              "count": 6,
              "dataSize": 546,
              "messageType": "InspectorStopProcess"
        },
        {
              "count": 1,
              "dataSize": 1553,
              "messageType": "InspectorInstanceMetaData"
        },
        {
              "count": 2,
              "dataSize": 434,
              "messageType": "InspectorTcpV4Connection"
        },
        {
              "count": 474,
              "dataSize": 2960322,
              "messageType": "InspectorPackageInfo"
        },
        {
              "count": 3,
              "dataSize": 2235,
              "messageType": "InspectorSystemPerformance"
        },
        {
              "count": 105,
              "dataSize": 46048,
              "messageType": "InspectorCodeModule"
        },
        {
              "count": 1,
              "dataSize": 182,
              "messageType": "InspectorUdpV6ListeningPort"
        },
        {
              "count": 2,
              "dataSize": 371,
              "messageType": "InspectorUdpV4ListeningPort"
        },
        {
              "count": 18,
              "dataSize": 8362,
              "messageType": "InspectorKernelModule"
        },
        {
              "count": 29,
              "dataSize": 48788,
              "messageType": "InspectorConfigurationInfo"
        },
        {
              "count": 1,
              "dataSize": 79,
              "messageType": "InspectorMonitoringStart"
        },
        {
              "count": 5,
              "dataSize": 0,
              "messageType": "InspectorSplitMsgBegin"
        },
        {
              "count": 51,
              "dataSize": 4593,
              "messageType": "InspectorGroup"
        },
        {
              "count": 1,
              "dataSize": 184,
              "messageType": "InspectorTcpV4ListeningPort"
        },
        {
              "count": 1159,
              "dataSize": 3146579,
              "messageType": "Total"
        },
        {
              "count": 5,
              "dataSize": 0,
              "messageType": "InspectorSplitMsgEnd"
        },
        {
              "count": 1,
              "dataSize": 612,
              "messageType": "InspectorLoadImageInProcess"
        }
      ]
}

列出账户权限

以下 list-account-permissions 示例列出您的账户权限。

aws inspector2 list-account-permissions

输出：

{
    "permissions": [
        {
            "operation": "ENABLE_SCANNING",
            "service": "ECR"
        },
        {
            "operation": "DISABLE_SCANNING",
            "service": "ECR"
        },
        {
            "operation": "ENABLE_REPOSITORY",
            "service": "ECR"
        },
        {
            "operation": "DISABLE_REPOSITORY",
            "service": "ECR"
        },
        {
            "operation": "ENABLE_SCANNING",
            "service": "EC2"
        },
        {
            "operation": "DISABLE_SCANNING",
            "service": "EC2"
        },
        {
            "operation": "ENABLE_SCANNING",
            "service": "LAMBDA"
        },
        {
            "operation": "DISABLE_SCANNING",
            "service": "LAMBDA"
        }
    ]
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的 Amazon Inspector 的身份和访问管理。

列出评估运行代理

以下 list-assessment-run-agents 命令列出具有指定 ARN 的评估运行的代理。

aws inspector list-assessment-run-agents \
    --assessment-run-arn arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE

输出：

{
    "assessmentRunAgents": [
        {
            "agentHealth": "HEALTHY",
            "agentHealthCode": "HEALTHY",
            "agentId": "i-49113b93",
            "assessmentRunArn": "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE",
            "telemetryMetadata": [
                {
                    "count": 2,
                    "dataSize": 345,
                    "messageType": "InspectorDuplicateProcess"
                },
                {
                    "count": 3,
                    "dataSize": 255,
                    "messageType": "InspectorTimeEventMsg"
                },
                {
                    "count": 4,
                    "dataSize": 1082,
                    "messageType": "InspectorNetworkInterface"
                },
                {
                    "count": 2,
                    "dataSize": 349,
                    "messageType": "InspectorDnsEntry"
                },
                {
                    "count": 11,
                    "dataSize": 2514,
                    "messageType": "InspectorDirectoryInfoMsg"
                },
                {
                    "count": 1,
                    "dataSize": 179,
                    "messageType": "InspectorTcpV6ListeningPort"
                },
                {
                    "count": 101,
                    "dataSize": 10949,
                    "messageType": "InspectorTerminal"
                },
                {
                    "count": 26,
                    "dataSize": 5916,
                    "messageType": "InspectorUser"
                },
                {
                    "count": 282,
                    "dataSize": 32148,
                    "messageType": "InspectorDynamicallyLoadedCodeModule"
                },
                {
                    "count": 18,
                    "dataSize": 10172,
                    "messageType": "InspectorCreateProcess"
                },
                {
                    "count": 3,
                    "dataSize": 8001,
                    "messageType": "InspectorProcessPerformance"
                },
                {
                    "count": 1,
                    "dataSize": 360,
                    "messageType": "InspectorOperatingSystem"
                },
                {
                    "count": 6,
                    "dataSize": 546,
                    "messageType": "InspectorStopProcess"
                },
                {
                    "count": 1,
                    "dataSize": 1553,
                    "messageType": "InspectorInstanceMetaData"
                },
                {
                    "count": 2,
                    "dataSize": 434,
                    "messageType": "InspectorTcpV4Connection"
                },
                {
                    "count": 474,
                    "dataSize": 2960322,
                    "messageType": "InspectorPackageInfo"
                },
                {
                    "count": 3,
                    "dataSize": 2235,
                    "messageType": "InspectorSystemPerformance"
                },
                {
                    "count": 105,
                    "dataSize": 46048,
                    "messageType": "InspectorCodeModule"
                },
                {
                    "count": 1,
                    "dataSize": 182,
                    "messageType": "InspectorUdpV6ListeningPort"
                },
                {
                    "count": 2,
                    "dataSize": 371,
                    "messageType": "InspectorUdpV4ListeningPort"
                },
                {
                    "count": 18,
                    "dataSize": 8362,
                    "messageType": "InspectorKernelModule"
                },
                {
                    "count": 29,
                    "dataSize": 48788,
                    "messageType": "InspectorConfigurationInfo"
                },
                {
                    "count": 1,
                    "dataSize": 79,
                    "messageType": "InspectorMonitoringStart"
                },
                {
                    "count": 5,
                    "dataSize": 0,
                    "messageType": "InspectorSplitMsgBegin"
                },
                {
                    "count": 51,
                    "dataSize": 4593,
                    "messageType": "InspectorGroup"
                },
                {
                    "count": 1,
                    "dataSize": 184,
                    "messageType": "InspectorTcpV4ListeningPort"
                },
                {
                    "count": 1159,
                    "dataSize": 3146579,
                    "messageType": "Total"
                },
                {
                    "count": 5,
                    "dataSize": 0,
                    "messageType": "InspectorSplitMsgEnd"
                },
                {
                    "count": 1,
                    "dataSize": 612,
                    "messageType": "InspectorLoadImageInProcess"
                }
            ]
        }
    ]
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的 AWS 代理。

列出评估运行

以下 list-assessment-runs 命令列出所有现有的评估运行。

aws inspector list-assessment-runs

输出：

{
    "assessmentRunArns": [
        "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE",
        "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-v5D6fI3v"
    ]
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的 Amazon Inspector 评估模板和评估运行。

列出评估目标

以下 list-assessment-targets 命令列出所有现有的评估目标：

aws inspector list-assessment-targets

输出：

{
       "assessmentTargetArns": [
       "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq"
       ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估目标”。

列出评估模板

以下 list-assessment-templates 命令列出所有现有的评估模板：

aws inspector list-assessment-templates

输出：

{
       "assessmentTemplateArns": [
       "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw",
       "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-Uza6ihLh"
       ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

示例 1：按组列出覆盖情况统计信息

以下 list-coverage-statistics 示例按组列出您的 AWS 环境的覆盖情况统计信息。

aws inspector2 list-coverage-statistics \
   --group-by RESOURCE_TYPE

输出：

{
    "countsByGroup": [
        {
            "count": 56,
            "groupKey": "AWS_LAMBDA_FUNCTION"
        },
        {
            "count": 27,
            "groupKey": "AWS_ECR_REPOSITORY"
        },
        {
            "count": 18,
            "groupKey": "AWS_EC2_INSTANCE"
        },
        {
            "count": 3,
            "groupKey": "AWS_ECR_CONTAINER_IMAGE"
        },
        {
            "count": 1,
            "groupKey": "AWS_ACCOUNT"
        }
    ],
    "totalCounts": 105
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的评估您的 AWS 环境的 Amazon Inspector 覆盖情况。

示例 2：按资源类型列出覆盖情况统计信息

以下 list-coverage-statistics 示例按资源类型列出您的 AWS 环境的覆盖情况统计信息。

aws inspector2 list-coverage-statistics
    --filter-criteria '{"resourceType":[{"comparison":"EQUALS","value":"AWS_ECR_REPOSITORY"}]}'
    --group-by SCAN_STATUS_REASON

输出：

{
    "countsByGroup": [
        {
            "count": 27,
            "groupKey": "SUCCESSFUL"
        }
    ],
    "totalCounts": 27
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的评估您的 AWS 环境的 Amazon Inspector 覆盖情况。

示例 3：按 ECR 存储库名称列出覆盖情况统计信息

以下 list-coverage-statistics 示例按 ECR 存储库名称列出您的 AWS 环境的覆盖情况统计信息。

aws inspector2 list-coverage-statistics
   --filter-criteria '{"ecrRepositoryName":[{"comparison":"EQUALS","value":"debian"}]}'
   --group-by SCAN_STATUS_REASON

输出：

{
    "countsByGroup": [
        {
            "count": 3,
            "groupKey": "SUCCESSFUL"
        }
    ],
    "totalCounts": 3
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的评估您的 AWS 环境的 Amazon Inspector 覆盖情况。

示例 1：列出有关您的环境的覆盖情况详细信息

以下 list-coverage 示例列出您的环境的覆盖情况详细信息。

aws inspector2 list-coverage

输出：

{
    "coveredResources": [
        {
            "accountId": "123456789012",
            "lastScannedAt": "2024-05-20T16:23:20-07:00",
            "resourceId": "i-EXAMPLE55555555555",
            "resourceMetadata": {
                "ec2": {
                    "amiId": "ami-EXAMPLE6666666666",
                    "platform": "LINUX"
                }
            },
            "resourceType": "AWS_EC2_INSTANCE",
            "scanStatus": {
                "reason": "SUCCESSFUL",
                "statusCode": "ACTIVE"
            },
            "scanType": "PACKAGE"
        }
    ]
}

示例 2：列出有关 Lambda 函数资源类型的覆盖情况详细信息

以下 list-coverage 示例列出您的 Lamda 函数资源类型详细信息。

aws inspector2 list-coverage
    --filter-criteria '{"resourceType":[{"comparison":"EQUALS","value":"AWS_LAMBDA_FUNCTION"}]}'

输出：

{
    "coveredResources": [
        {
            "accountId": "123456789012",
            "resourceId": "arn:aws:lambda:us-west-2:123456789012:function:Eval-container-scan-results:$LATEST",
            "resourceMetadata": {
                "lambdaFunction": {
                    "functionName": "Eval-container-scan-results",
                    "functionTags": {},
                    "layers": [],
                    "runtime": "PYTHON_3_7"
                }
            },
            "resourceType": "AWS_LAMBDA_FUNCTION",
            "scanStatus": {
                "reason": "SUCCESSFUL",
                "statusCode": "ACTIVE"
            },
            "scanType": "CODE"
        }
    ]
}

列出有关您的组织的委派管理员账户的信息

以下 list-delegated-admin-accounts 示例列出有关您的组织的委派管理员账户的信息。

aws inspector2 list-delegated-admin-accounts

输出：

{
    "delegatedAdminAccounts": [
        {
            "accountId": "123456789012",
            "status": "ENABLED"
        }
    ]
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的为 Amazon Inspector 指定委派管理员。

列出事件订阅

以下 list-event-subscriptions 命令列出 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-7sbz2Kz0 的评估模板的所有事件订阅：

aws inspector list-event-subscriptions --resource-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-7sbz2Kz0

输出：

{
      "subscriptions": [
        {
              "eventSubscriptions": [
                {
                      "event": "ASSESSMENT_RUN_COMPLETED",
                      "subscribedAt": 1459455440.867
                }
              ],
              "resourceArn": "arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-7sbz2Kz0",
              "topicArn": "arn:aws:sns:us-west-2:123456789012:exampletopic"
        }
      ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

列出与您用于激活 Amazon Inspector 的账户相关的筛选器

以下 list-filters 示例列出与您用于激活 Amazon Inspector 的账户相关的筛选器。

aws inspector2 list-filters

输出：

{
    "filters": [
        {
            "action": "SUPPRESS",
            "arn": "arn:aws:inspector2:us-west-2:123456789012:owner/o-EXAMPLE222/filter/EXAMPLE444444444",
            "createdAt": "2024-05-15T21:11:08.602000+00:00",
            "criteria": {
                "resourceType": [
                    {
                        "comparison": "EQUALS",
                        "value": "AWS_EC2_INSTANCE"
                    },
                ]
            },
            "description": "This suppression rule omits EC2 instance type findings",
            "name": "ExampleSuppressionRuleEC2",
            "ownerId": "o-EXAMPLE222",
            "tags": {},
            "updatedAt": "2024-05-15T21:11:08.602000+00:00"
        },
        {
            "action": "SUPPRESS",
            "arn": "arn:aws:inspector2:us-east-1:813737243517:owner/o-EXAMPLE222/filter/EXAMPLE444444444",
            "createdAt": "2024-05-15T21:28:27.054000+00:00",
            "criteria": {
                "resourceType": [
                    {
                        "comparison": "EQUALS",
                        "value": "AWS_ECR_INSTANCE"
                    }
                ]
            },
            "description": "This suppression rule omits ECR instance type findings",
            "name": "ExampleSuppressionRuleECR",
            "ownerId": "o-EXAMPLE222",
            "tags": {},
            "updatedAt": "2024-05-15T21:28:27.054000+00:00"
        }
    ]
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的筛选 Amazon Inspector 调查发现。

列出调查发现

以下 list-findings 命令列出所有生成的调查发现：

aws inspector list-findings

输出：

{
        "findingArns": [
        "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE/finding/0-HwPnsDm4",
        "arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-v5D6fI3v/finding/0-tyvmqBLy"
      ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 调查发现”。

示例 1：列出与组织的 Amazon Inspector 委托管理员关联的所有成员账户

aws inspector2 list-members --only-associated

输出：

{
        {
             "members": [
        {
             "accountId": "123456789012",
             "delegatedAdminAccountId": "123456789012",
             "relationshipStatus": "ENABLED",
             "updatedAt": "2023-09-11T09:57:20.520000-07:00"
        },
        {
             "accountId": "123456789012",
             "delegatedAdminAccountId": "123456789012",
             "relationshipStatus": "ENABLED",
             "updatedAt": "2024-08-12T10:13:01.472000-07:00"
        },
        {
             "accountId": "625032911453",
             "delegatedAdminAccountId": "123456789012",
             "relationshipStatus": "ENABLED",
             "updatedAt": "2023-09-11T09:57:20.438000-07:00"
        },
        {
            "accountId": "715411239211",
            "delegatedAdminAccountId": "123456789012",
            "relationshipStatus": "ENABLED",
            "updatedAt": "2024-04-24T09:14:57.471000-07:00"
        }
    ]
}

有关更多信息，请参阅《Amazon Inspector User Guide》中的 Managing multiple accounts in Amazon Inspector with AWS Organizations。

示例 2：列出与组织的 Amazon Inspector 委托管理员关联和取消关联的所有成员账户

aws inspector2 list-members --no-only-associated

输出：

{
        {
            "members": [
        {
            "accountId": "123456789012",
            "delegatedAdminAccountId": "123456789012",
            "relationshipStatus": "REMOVED",
            "updatedAt": "2024-05-15T11:34:53.326000-07:00"
        },
        {
            "accountId": "123456789012",
            "delegatedAdminAccountId": "123456789012",
            "relationshipStatus": "ENABLED",
            "updatedAt": "2023-09-11T09:57:20.520000-07:00"
        },
        {
            "accountId": "123456789012",
            "delegatedAdminAccountId": "123456789012",
            "relationshipStatus": "ENABLED",
            "updatedAt": "2024-08-12T10:13:01.472000-07:00"
        },
        {
            "accountId": "123456789012",
            "delegatedAdminAccountId": "123456789012",
            "relationshipStatus": "ENABLED",
            "updatedAt": "2023-09-11T09:57:20.438000-07:00"
        },
        {
            "accountId": "123456789012",
            "delegatedAdminAccountId": "123456789012",
            "relationshipStatus": "ENABLED",
            "updatedAt": "2024-04-24T09:14:57.471000-07:00"
        }
    ]
}

有关更多信息，请参阅《Amazon Inspector User Guide》中的 Managing multiple accounts in Amazon Inspector with AWS Organizations。

列出规则包

以下 list-rules-packages 命令列出所有可用的 Inspector 规则包：

aws inspector list-rules-packages

输出：

{
       "rulesPackageArns": [
         "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-9hgA516p",
         "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-H5hpSawc",
         "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-JJOtZiqQ",
         "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-vg5GGHSD"
       ]
 }

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 规则包和规则”。

列出资源标签

以下 list-tags-for-resource 命令列出与 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-gcwFliYu 的评估模板关联的所有标签：

aws inspector list-tags-for-resource --resource-arn arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-gcwFliYu

输出：

{
      "tags": [
        {
              "key": "Name",
              "value": "Example"
        }
      ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

列出过去 30 天的总使用量

以下 list-usage-totals 示例列出了过去 30 天的总使用量。

aws inspector2 list-usage-totals

输出：

{
    "totals": [
        {
            "accountId": "123456789012",
            "usage": [
                {
                    "currency": "USD",
                    "estimatedMonthlyCost": 4.6022044647,
                    "total": 1893.4784083333334,
                    "type": "EC2_AGENTLESS_INSTANCE_HOURS"
                },
                {
                    "currency": "USD",
                    "estimatedMonthlyCost": 18.892449279,
                    "total": 10882.050784722222,
                    "type": "EC2_INSTANCE_HOURS"
                },
                {
                    "currency": "USD",
                    "estimatedMonthlyCost": 5.4525363736,
                    "total": 6543.043648333333,
                    "type": "LAMBDA_FUNCTION_CODE_HOURS"
                },
                {
                    "currency": "USD",
                    "estimatedMonthlyCost": 3.9064080309,
                    "total": 9375.379274166668,
                    "type": "LAMBDA_FUNCTION_HOURS"
                },
                {
                    "currency": "USD",
                    "estimatedMonthlyCost": 0.06,
                    "total": 6.0,
                    "type": "ECR_RESCAN"
                },
                {
                    "currency": "USD",
                    "estimatedMonthlyCost": 0.09,
                    "total": 1.0,
                    "type": "ECR_INITIAL_SCAN"
                }
            ]
        }
    ]
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的在 Amazon Inspector 中监控使用量和成本。

预览代理

以下 preview-agents 命令预览安装在 EC2 实例上的代理，这些代理属于 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq 的评估目标的一部分：

aws inspector preview-agents --preview-agents-arn arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq

输出：

{
      "agentPreviews": [
        {
              "agentId": "i-49113b93"
        }
      ]
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估目标”。

注册跨账户访问角色

以下 register-cross-account-access-role 命令注册 ARN 为 arn:aws:iam::123456789012:role/inspector 的 IAM 角色，当您调用 preview-agents 命令时，Amazon Inspector 使用该角色在评估运行开始时列出您的 EC2 实例：

aws inspector register-cross-account-access-role --role-arn arn:aws:iam::123456789012:role/inspector

有关更多信息，请参阅《Amazon Inspector》指南中的“设置 Amazon Inspector”。

从调查发现中移除属性

以下 remove-attributes-from-finding 命令从 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-8l1VIE0D/run/0-Z02cjjug/finding/0-T8yM9mEU 的调查发现中移除键为 Example 且值为 example 的属性：

aws inspector remove-attributes-from-findings --finding-arns arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-8l1VIE0D/run/0-Z02cjjug/finding/0-T8yM9mEU --attribute-keys key=Example,value=example

输出：

{
      "failedItems": {}
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 调查发现”。

为资源设置标签

以下 set-tags-for-resource 命令为 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-7sbz2Kz0 的评估模板设置键为 Example 且值为 example 的标签：

aws inspector set-tags-for-resource --resource-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-7sbz2Kz0 --tags key=Example,value=example

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

启动评估运行

以下 start-assessment-run 命令使用 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T 的评估模板启动名为 examplerun 的评估运行：

aws inspector start-assessment-run --assessment-run-name examplerun --assessment-template-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T

输出：

{
      "assessmentRunArn": "arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T/run/0-jOoroxyY"
}

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

停止评估运行

以下 stop-assessment-run 命令停止 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T/run/0-jOoroxyY 的评估运行：

aws inspector stop-assessment-run --assessment-run-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-it5r2S4T/run/0-jOoroxyY

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

订阅事件

以下示例启用向 ARN 为 arn:aws:sns:us-west-2:123456789012:exampletopic 的主题发送有关 ASSESSMENT_RUN_COMPLETED 事件的 Amazon SNS 通知的流程，

aws inspector subscribe-to-event \
    --event ASSESSMENT_RUN_COMPLETED \
    --resource-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-7sbz2Kz0 \
    --topic-arn arn:aws:sns:us-west-2:123456789012:exampletopic

此命令不生成任何输出。

有关更多信息，请参阅《Amazon Inspector》指南中的 Amazon Inspector 评估模板和评估运行。

取消订阅事件

以下 unsubscribe-from-event 命令禁用向 ARN 为 arn:aws:sns:us-west-2:123456789012:exampletopic 的主题发送有关 ASSESSMENT_RUN_COMPLETED 事件的 Amazon SNS 通知的流程：

aws inspector unsubscribe-from-event --event ASSESSMENT_RUN_COMPLETED --resource-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-7sbz2Kz0 --topic arn:aws:sns:us-west-2:123456789012:exampletopic

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估模板和评估运行”。

更新评估目标

以下 update-assessment-target 命令将评估目标更新为 ARN 为 arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX，名称为 Example，资源组的 ARN 为 arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-yNbgL5Pt：

aws inspector update-assessment-target --assessment-target-arn arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX --assessment-target-name Example --resource-group-arn arn:aws:inspector:us-west-2:123456789012:resourcegroup/0-yNbgL5Pt

有关更多信息，请参阅《Amazon Inspector》指南中的“Amazon Inspector 评估目标”。

更新筛选器

以下 update-filter 示例更新筛选器，以忽略 Lambda 调查发现而不是 ECR 实例调查发现。

aws inspector2 update-filter \
   --filter-arn "arn:aws:inspector2:us-west-2:123456789012:owner/o-EXAMPLE222/filter/EXAMPLE444444444" \
   --name "ExampleSuppressionRuleLambda" \
   --description "This suppression rule omits Lambda instance findings" \
   --reason "Updating filter to omit Lambda instance findings instead of ECR instance findings"

输出：

{
    "filters": [
        {
            "action": "SUPPRESS",
            "arn": "arn:aws:inspector2:us-west-2:123456789012:owner/o-EXAMPLE222/filter/EXAMPLE444444444",
            "createdAt": "2024-05-15T21:28:27.054000+00:00",
            "criteria": {
                "resourceType": [
                    {
                        "comparison": "EQUALS",
                        "value": "AWS_ECR_INSTANCE"
                    }
                ]
            },
            "description": "This suppression rule omits Lambda instance findings",
            "name": "ExampleSuppressionRuleLambda",
            "ownerId": "o-EXAMPLE222",
            "reason": "Updating filter to omit Lambda instance findings instead of ECR instance findings",
            "tags": {},
            "updatedAt": "2024-05-15T22:23:13.665000+00:00"
        }
    ]
}

有关更多信息，请参阅《Amazon Inspector 用户指南》中的在 Amazon Inspector 中管理调查发现。