Prevent AWS inspector scanning AWS ec2 instance from autoscaling groups

Question

Prevent AWS inspector scanning AWS ec2 instance from autoscaling groups.
The AMI we use we scan separately and we don't need to scan each instance on its own.
Is there a way to prevent scans of some ec2 instances from inspector.

Answer

To exclude an EC2 instance from scans, tag that instance with the following key:

```
InspectorEc2Exclusion
```

AWS documentation [here](https://docs.aws.amazon.com/inspector/latest/user/scanning-ec2.html#exclude-ec2)

Answer

Remove SSM agent from the instances  where you dont want the scan to happen and or remove SSM permissions from the instance IAM role.
Without SSM agent installed or IAM permissions inspector will not be able to access.

Answer

If you're using New AWS Inspector, Unfortunately, it's not possible to prevent scan of some EC2 instances as of now.

Amazon Inspector automatically discovers all supported EC2 instances and then scan it automatically. Please refer to below for more details.
 
https://docs.aws.amazon.com/inspector/latest/user/enable-disable-scanning-ec2.html

Answer

if the instance doesn't meet Inspector prerequisites then it won't be scanned. The prerequisites is mainly being a managed instance in Systems Manager.

Prevent AWS inspector scanning AWS ec2 instance from autoscaling groups

관련 콘텐츠