[Update] I Tried On-Demand Scanning of an AMI Without Enabling Amazon Inspector

Introduction

Amazon Inspector now supports on-demand scanning, which lets you easily scan AMIs.

https://docs.aws.amazon.com/inspector/latest/user/machine-image-on-demand.html

Until now, to check an AMI for vulnerabilities with Inspector, you had to launch an instance from the AMI and scan that instance.

On-demand scanning reads the AMI's snapshots directly, so you can scan without launching an instance. It is also reported that scanning is possible even in accounts where Inspector is disabled.

As for how to receive the results, the documentation differs. The Inspector documentation says "results are delivered only to Amazon EventBridge," while the EC2 documentation says "results are sent to EC2 and can be retrieved with the EC2 API."

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-scanning.html

So in this article, I will scan AMIs in an account with Inspector disabled and check how the results are delivered.

Test environment

I will test in an account with Inspector disabled. Also, only AMIs owned by your own account can be targeted by on-demand scanning, so I copied two public Amazon Linux 2023 AMIs into my own account.

Events delivered to EventBridge were received by a rule on the default event bus and stored in CloudWatch Logs.

Running a scan

Pass an AMI ID to start-on-demand-scan and the scan starts, returning a scanId.

aws inspector2 start-on-demand-scan \
  --resource-id ami-07d2ba94d48bca823 \
  --resource-type AMI

{
    "scanId": "842d9c96f14e40559b8fc450ba747577"
}

The IAM principal that runs it needs the iam:CreateServiceLinkedRole permission in addition to inspector2:StartOnDemandScan. On the first scan, the service-linked role AWSServiceRoleForAmazonInspector2Ami for reading snapshots was created.

Check the scan status by passing the AMI ID and scanId to get-on-demand-scan-status.

aws inspector2 get-on-demand-scan-status \
  --resource-id ami-07d2ba94d48bca823 \
  --resource-type AMI \
  --scan-id 842d9c96f14e40559b8fc450ba747577

{
    "scanId": "842d9c96f14e40559b8fc450ba747577",
    "resourceId": "ami-07d2ba94d48bca823",
    "resourceType": "AMI",
    "scanStatus": "SUCCESSFUL",
    "startedAt": "2026-10-29T09:52:31.968000+00:00",
    "completedAt": "2026-10-29T09:58:36.442000+00:00"
}

Both AMIs reached SUCCESSFUL in about 6 minutes! The scan finished without launching a single instance, which is convenient.

Checking results with EC2

To check whether the results can be viewed without EventBridge, I ran EC2's describe-images and get-image-findings.

Viewing the summary with describe-images

The ScanResults in describe-images contains a summary, such as the highest severity of the findings.

aws ec2 describe-images \
  --image-ids ami-07d2ba94d48bca823 ami-08b070da26a7579d0 \
  --query "Images[].ScanResults"

[
    {
        "HighestFindingSeverityLabel": "critical",
        "FindingScanDate": "2026-10-29T09:52:31.968000+00:00",
        "LowFixAvailableSince": "2026-10-29T09:58:30.471000+00:00",
        "MediumFixAvailableSince": "2026-10-29T09:58:30.471000+00:00",
        "HighFixAvailableSince": "2026-10-29T09:58:30.471000+00:00",
        "CriticalFixAvailableSince": "2026-10-29T09:58:30.542000+00:00"
    },
    {
        "FindingScanDate": "2026-10-29T09:52:22.201000+00:00"
    }
]

For the old AMI, the highest severity was critical, and *FixAvailableSince, which indicates that fixes are available for each severity, was also included. For the new AMI, which had 0 findings, only FindingScanDate, the date and time of the scan, was returned.

Viewing findings with get-image-findings

aws ec2 get-image-findings --image-id ami-07d2ba94d48bca823

The old AMI had 4,186 findings, and the new AMI had 0.

As an example, one critical finding had the following content.

{
    "FixAvailable": true,
    "Score": 9.9,
    "FirstObservedAt": "2026-10-29T09:58:30.542000+00:00",
    "UpdatedAt": "2026-10-29T09:58:30.542000+00:00",
    "Title": "CVE-2026-89049 - amazon-ssm-agent",
    "Paths": [
        "/var/lib/rpm/rpmdb.sqlite"
    ],
    "SeverityLabel": "critical",
    "SnapshotId": "snap-0db91065890272669"
}

Each finding comes with the ID of the EBS snapshot where the vulnerability was found and the file path. Note that CVE descriptions and fixed versions are not included in get-image-findings.

The Inspector documentation said "results are delivered only to EventBridge," but they could be retrieved properly through the EC2 API too.

Checking the EC2 console display

The documentation says you can check the results in the "Security" tab of the AMI in the EC2 console. However, at the time of writing, that tab was not on the AMI details screen. Perhaps it has not yet been reflected in the console.

Receiving events with EventBridge

The following two kinds of events arrived on the default event bus.

Scan complete event

The scan complete event contains the count for each severity in findingSeverityCounts, as in the example below.

{
  "version": "0",
  "id": "ed10a415-0d57-5c57-14ed-23d77d0fadb1",
  "detail-type": "Inspector2 OnDemand Scan Complete",
  "source": "aws.inspector2",
  "account": "123456789012",
  "time": "2026-10-29T09:58:24Z",
  "region": "ap-northeast-1",
  "resources": [
    "ami-08b070da26a7579d0"
  ],
  "detail": {
    "scanId": "b63e50341444477cb48b75d21796aa6f",
    "awsAccountId": "123456789012",
    "resourceId": "ami-08b070da26a7579d0",
    "resourceType": "MACHINE_IMAGE",
    "scanStatus": "SUCCESSFUL",
    "startedAt": "2026-10-29T09:52:22.201Z",
    "completedAt": "2026-10-29T09:58:24.165Z",
    "findingSeverityCounts": {
      "CRITICAL": 0,
      "HIGH": 0,
      "MEDIUM": 0,
      "LOW": 0,
      "INFORMATIONAL": 0,
      "UNTRIAGED": 0,
      "TOTAL": 0
    },
    "version": "1.0"
  }
}

Finding event

The finding event contains things that get-image-findings does not, such as the CVE description, the CVSS score, the fixed version, and reference URLs. It can be linked to the completion event of the same scan by detail.scanId.

For the old AMI, more than 4,000 finding events were issued in a batch, so the completion event arrived first. If you trigger processing from the completion event, it is more reliable to compare findingSeverityCounts.TOTAL with the number of events received, or to re-fetch with get-image-findings.

Conclusion

I tried Amazon Inspector's on-demand scanning of AMIs in an account with Inspector disabled.

You can use EC2's get-image-findings to easily retrieve results, and EventBridge for automation.

However, with EventBridge, thousands of events were issued in a batch, and the completion event sometimes arrived before the findings. Pay attention to the counts, and check the volume before processing.