[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nThe Vulnerability Assessment for Amazon Web Services (AWS) service detects vulnerabilities in the\nfollowing AWS resources:\n\n- Software packages installed on [Amazon EC2 instances](https://aws.amazon.com/ec2/)\n- Software packages and operating system misconfigurations in Elastic Container Registry (ECR) images\n\nThe Vulnerability Assessment for AWS service scans snapshots of the running EC2 instances,\nso production workloads are unaffected. This scan method is called\n*agentless disk scanning*, because no agents are installed on the target EC2\nmachines.\n\nThe Vulnerability Assessment for AWS service runs on the\n[AWS Lambda service](https://aws.amazon.com/lambda/) and deploys EC2 instances\nthat host scanners, create snapshots of the target EC2 instances, and scan the\nsnapshots.\n\nYou can set the scan interval from 6 to 24 hours.\n\nFor each detected vulnerability, Vulnerability Assessment for AWS generates a *finding* in\nSecurity Command Center. A finding is a record of the vulnerability that contains\ndetails about the affected AWS resource and the vulnerability, including\ninformation from the associated\n[Common Vulnerability and Exposures (CVEs)](https://www.cve.org/) record.\n\nFor more information about the findings that are produced by\nVulnerability Assessment for AWS, see [Vulnerability Assessment for AWS findings](#findings).\n\nFindings generated by Vulnerability Assessment for AWS\n\nWhen the Vulnerability Assessment for AWS service detects a software vulnerability on an\nAWS EC2 machine or in an Elastic Container Registry image, the service generates\na finding in Security Command Center on Google Cloud.\n\nThe individual findings and their corresponding detection modules are not listed\nin the Security Command Center documentation.\n\nEach finding contains the following information that is unique to the detected\nsoftware vulnerability:\n\n- The full resource name of the affected instance or image\n- A description of the vulnerability, including the following information:\n - The software package that contains the vulnerability\n - Information from the associated CVE record\n - An assessment from Mandiant of the impact and exploitability of the vulnerability\n - An assessment from Security Command Center of the severity of the vulnerability\n- An attack exposure score to help you prioritize remediation\n- A visual representation of the path an attacker might take to the high-value resources that are exposed by the vulnerability\n- If available, steps that you can take to fix the issue, including the patch or version upgrade that you can use to address the vulnerability\n\nAll Vulnerability Assessment for AWS findings share the following property values:\n\nCategory\n: `Software vulnerability`\n\nClass\n: `Vulnerability`\n\nCloud service provider\n: `Amazon Web Services`\n\nSource\n: `EC2 Vulnerability Assessment`\n\nFor information about viewing findings in the Google Cloud console, see\n[Review findings in the Google Cloud console](/security-command-center/docs/vulnerability-assessment-aws-enable#findings-console).\n\nResources used during scans\n\nDuring scanning, Vulnerability Assessment for AWS uses resources on both Google Cloud\nand on AWS.\n\nGoogle Cloud resource usage\n\nThe resources that Vulnerability Assessment for AWS uses on Google Cloud are included\nin the cost of Security Command Center.\n\nThese resources include\n[tenant projects](/service-infrastructure/docs/glossary#tenant),\n[Cloud Storage buckets](/storage/docs/buckets), and\n[Workload Identity Federation](/iam/docs/workload-identity-federation). These\nresources are managed by Google Cloud and are used only during active\nscans.\n\nVulnerability Assessment for AWS also uses the Cloud Asset API to retrieve information about\nAWS accounts and resources.\n\nAWS resource usage\n\nOn AWS, Vulnerability Assessment for AWS uses the\n[AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html)\nand [Amazon Virtual Private Cloud (Amazon VPC)](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)\nservices. After scanning is complete, the Vulnerability Assessment for AWS service stops\nusing these AWS services.\n\nAWS bills your AWS account for the use of these services and does not identify\nthe usage as being associated with Security Command Center or the\nVulnerability Assessment for AWS service.\n\nService identity and permissions\n\nFor the actions that it performs on Google Cloud, the\nVulnerability Assessment for AWS service uses the following\n[Security Command Center service agent](/security-command-center/docs/access-control-org#service-agent)\nat the organization level for identity and for permission to access\nGoogle Cloud resources: \n\n service-org-\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e@security-center-api.iam.gserviceaccount.com\n\nThis service agent contains the `cloudasset.assets.listResource` permission,\nwhich Vulnerability Assessment for AWS service uses to retrieve information about the\ntarget AWS accounts from [Cloud Asset Inventory](/asset-inventory/docs/overview).\n\nFor the actions that Vulnerability Assessment for AWS performs on AWS, you create an AWS\nIAM role and assign the role to the Vulnerability Assessment for AWS service when you\nconfigure the required AWS CloudFormation template. For instructions, see\n[Roles and permissions](/security-command-center/docs/vulnerability-assessment-aws-enable#roles_and_permissions)."]]
