View a markdown version of this page

ScanResultCondition - Amazon Elastic Compute Cloud
ContentsSee Also

ScanResultCondition

The Amazon Inspector scan-result criteria that an AMI must meet to be allowed. The criteria can limit the highest finding severity. They can also limit, for each severity, the days since Amazon Inspector reported a fix as available.

The severity limit applies to all findings, whether or not a fix is available. The day limits for each severity apply only to findings that have a fix available. A scanned AMI that has no fix-available finding of a given severity meets that severity's day limit. AMIs that Amazon Inspector has not scanned are not allowed when you specify this condition.

Contents

maxDaysSinceCriticalFixAvailable

The maximum number of days since Amazon Inspector reported a fix as available for a critical severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.

A scanned AMI that has no critical severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.

Constraints: Minimum value of 0. Maximum value of 2147483647.

Type: Integer

Valid Range: Minimum value of 0. Maximum value of 2147483647.

Required: No

maxDaysSinceHighFixAvailable

The maximum number of days since Amazon Inspector reported a fix as available for a high severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.

A scanned AMI that has no high severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.

Constraints: Minimum value of 0. Maximum value of 2147483647.

Type: Integer

Valid Range: Minimum value of 0. Maximum value of 2147483647.

Required: No

maxDaysSinceInformationalFixAvailable

The maximum number of days since Amazon Inspector reported a fix as available for an informational severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.

A scanned AMI that has no informational severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.

Constraints: Minimum value of 0. Maximum value of 2147483647.

Type: Integer

Valid Range: Minimum value of 0. Maximum value of 2147483647.

Required: No

maxDaysSinceLastFindingScan

The maximum number of days that have elapsed since Amazon Inspector last scanned the AMI. For example, a value of 7 allows AMIs that were scanned within the last 7 days. AMIs that Amazon Inspector has not scanned are not allowed.

Constraints: Minimum value of 0. Maximum value of 2147483647.

Type: Integer

Valid Range: Minimum value of 0. Maximum value of 2147483647.

Required: No

maxDaysSinceLowFixAvailable

The maximum number of days since Amazon Inspector reported a fix as available for a low severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.

A scanned AMI that has no low severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.

Constraints: Minimum value of 0. Maximum value of 2147483647.

Type: Integer

Valid Range: Minimum value of 0. Maximum value of 2147483647.

Required: No

maxDaysSinceMediumFixAvailable

The maximum number of days since Amazon Inspector reported a fix as available for a medium severity finding on the AMI. For example, a value of 7 does not allow an AMI if Amazon Inspector reported such a fix more than 7 days ago.

A scanned AMI that has no medium severity finding with a fix available meets this limit. AMIs that Amazon Inspector has not scanned are not allowed.

Constraints: Minimum value of 0. Maximum value of 2147483647.

Type: Integer

Valid Range: Minimum value of 0. Maximum value of 2147483647.

Required: No

maximumSeverityLabel

The maximum severity that an AMI's Amazon Inspector findings can have for the AMI to be allowed. Findings count whether or not a fix is available. For example, a value of medium allows AMIs whose highest severity is informational, low, or medium.

The valid values are the following Amazon Inspector severity levels, which correspond to CVSS score ranges:

  • informational - CVSS score of 0.

  • low - CVSS score of 0.1 to 3.9.

  • medium - CVSS score of 4.0 to 6.9.

  • high - CVSS score of 7.0 to 8.9.

  • critical - CVSS score of 9.0 to 10.0.

For more information, see Software package vulnerability severity in the Amazon Inspector User Guide.

A scanned AMI that has no findings meets this limit.

AMIs that Amazon Inspector has not scanned are not allowed when you specify this condition.

Type: String

Valid Values: informational | low | medium | high | critical

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: