Back to Checks
aws

Inspector2 covered resource was scanned within the configured number of days

inspector2_coverage_recently_scanned
Service: inspector2Severity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:Other

Amazon Inspector coverage is evaluated for every actively monitored resource. The time since the resource was last scanned (lastScannedAt) is compared with the configurable inspector2_max_days_since_last_scan threshold (3 days by default).

Resources still pending their first scan are not evaluated.

Prowler logoProwlerprowler-provider-aws

Risk

Stale scans leave newly published CVEs and configuration drift undetected. A resource that has not been rescanned for weeks can keep running exploitable packages long after a fix is available.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks inspector2_coverage_recently_scanned

Recommendation

Keep continuous scanning healthy: use hybrid EC2 scanning so instances without a working SSM agent are still scanned, set a long ECR rescan duration for images in use, and investigate every resource whose last scan is older than the allowed window.

Remediation

Other

1In the Amazon Inspector console, choose Account management and review the Last scanned at value in the Instances, Container images and Lambda functions tabs
2For EC2 instances, confirm the SSM Agent is healthy or, under General settings > EC2 scanning settings, set the scan mode to hybrid
3For ECR images, increase the Amazon ECR re-scan duration in the Amazon Inspector settings
4Confirm the resources are rescanned

Check Code

from datetime import datetime, timedelta, timezone

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.inspector2.inspector2_client import (
    inspector2_client,
)

PENDING_SCAN_REASONS = {
    "PENDING_INITIAL_SCAN",
    "PENDING_REVIVAL_SCAN",
    "SCAN_IN_PROGRESS",
}


class inspector2_coverage_recently_scanned(Check):
    """Ensure Inspector2 scanned every actively covered resource within the configured days."""

    def execute(self) -> list[Check_Report_AWS]:
        """Report whether each actively covered resource was scanned within the allowed days."""
        findings = []
        max_days = inspector2_client.audit_config.get(
            "inspector2_max_days_since_last_scan", 3
        )
        max_elapsed = timedelta(days=max_days)
        now = datetime.now(timezone.utc)
        for inspector in inspector2_client.inspectors:
            if inspector.status != "ENABLED":
                continue
            if inspector.coverage is None:
                report = Check_Report_AWS(metadata=self.metadata(), resource=inspector)
                report.status = "MANUAL"
                report.status_extended = (
                    f"Inspector2 coverage could not be retrieved in region {inspector.region}; "
                    "verify the inspector2:ListCoverage permission."
                )
                findings.append(report)
                continue
            for resource in inspector.coverage:
                if resource.scan_status_code != "ACTIVE":
                    continue
                if (
                    resource.last_scanned_at is None
                    and resource.scan_status_reason in PENDING_SCAN_REASONS
                ):
                    continue
                report = Check_Report_AWS(metadata=self.metadata(), resource=resource)
                if resource.last_scanned_at is None:
                    report.status = "FAIL"
                    report.status_extended = f"{resource.resource_type} {resource.id} has no recorded Inspector2 scan."
                elif now - resource.last_scanned_at > max_elapsed:
                    report.status = "FAIL"
                    report.status_extended = f"{resource.resource_type} {resource.id} was last scanned by Inspector2 more than {max_days} days ago."
                else:
                    report.status = "PASS"
                    report.status_extended = f"{resource.resource_type} {resource.id} was last scanned by Inspector2 within the last {max_days} days."
                findings.append(report)
        return findings

References