All scans are automatically performed based on events. All workloads are initially scanned upon discovery and subsequently rescanned.
For Amazon EC2 instances: For SSM agent-based scans, rescans are started when a new software package is installed or uninstalled on an instance, when a new CVE is published, and after a vulnerable package is updated (to confirm there are no additional vulnerabilities). For agentless scans, scans are performed every 24 hours.
For Amazon ECR container images: Automated re-scans are started for eligible container images when a new CVE affecting an image is published. The automated rescans for container images are based on the rescan durations configured for both image push date and pull date in the Amazon Inspector console or APIs. If the push date of an image is less than the configured “Push date rescan duration” and image has been pulled within the configured “Pull date rescan duration”, the container image will continue to be monitored and automated rescans are started when a new CVE affecting an image is published. Available re-scan duration configurations for image push date are 90 days (by default), 14 days, 30 days, 60 days, 180 days, or lifetime. The rescan duration configurations for image pull date are 90 days (by default), 14 days, 30 days, 60 days, or 180 days.
For Lambda functions: All new Lambda functions are initially assessed upon discovery, and continually reassessed when there is an update to the Lambda function or a new CVE is published.