Amazon EC2 Image Builder ListImageScanFindings API

openapi: 3.1.0
info:
  title: EC2 Image Builder Listimagescanfindings API
  version: '2019-12-02'
  description: Generated from AWS's published Smithy model for EC2 Image Builder. 1 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://imagebuilder.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /ListImageScanFindings:
    post:
      operationId: ListImageScanFindings
      summary: List Image Scan Findings
      description: Returns a list of image scan findings for your account. Amazon Inspector generates the findings when it
        scans images that have scanning enabled.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListImageScanFindingsResponse'
              example:
                requestId: 233de8e7-3b58-4319-a6af-f6774cf7d371
                findings:
                - awsAccountId: '111122223333'
                  imageBuildVersionArn: arn:aws:imagebuilder:us-west-2:111122223333:image/my-example-recipe/1.0.0/1
                  imagePipelineArn: arn:aws:imagebuilder:us-west-2:111122223333:image-pipeline/my-example-pipeline
                  type: PACKAGE_VULNERABILITY
                  description: 'In the Linux kernel, the following vulnerability has been resolved:


                    virtio: break and reset virtio devices on device_shutdown()'
                  title: CVE-2025-38064 - kernel
                  remediation:
                    recommendation:
                      text: None Provided
                  severity: HIGH
                  firstObservedAt: '2026-01-06T20:12:57Z'
                  updatedAt: '2026-01-06T20:12:57Z'
                  inspectorScore: 7.0
                  inspectorScoreDetails:
                    adjustedCvss:
                      scoreSource: AMAZON_CVE
                      cvssSource: AMAZON_CVE
                      version: '3.1'
                      score: 7.0
                      scoringVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
                      adjustments: []
                  packageVulnerabilityDetails:
                    vulnerabilityId: CVE-2025-38064
                    vulnerablePackages:
                    - name: kernel
                      version: 4.14.355
                      epoch: 0
                      release: 280.652.amzn2
                      arch: X86_64
                      packageManager: OS
                      fixedInVersion: 0:5.15.189-131.202.amzn2
                      remediation: yum update kernel
                    source: AMAZON_CVE
                    cvss:
                    - baseScore: 7.0
                      scoringVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
                      version: '3.1'
                      source: AMAZON_CVE
                    relatedVulnerabilities:
                    - ALAS2-2025-2955
                    - ALAS2023-2025-1130
                    sourceUrl: https://alas.aws.amazon.com/cve/json/v1/CVE-2025-38064.json
                    vendorSeverity: Important
                    vendorCreatedAt: '2025-06-18T00:00:00Z'
                    vendorUpdatedAt: '2025-06-25T00:00:00Z'
                    referenceUrls:
                    - https://alas.aws.amazon.com/AL2/ALAS2-2025-2955.html
                    - https://alas.aws.amazon.com/AL2023/ALAS2023-2025-1130.html
                  fixAvailable: 'YES'
        '429':
          description: CallRateLimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CallRateLimitExceededException'
        '400':
          description: ClientException; InvalidPaginationTokenException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientException'
        '403':
          description: ForbiddenException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenException'
        '500':
          description: ServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '503':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListImageScanFindingsRequest'
            example:
              filters:
              - name: imageBuildVersionArn
                values:
                - arn:aws:imagebuilder:us-west-2:111122223333:image/my-example-recipe/1.0.0/1
      tags:
      - Listimagescanfindings
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: imagebuilder
  schemas:
    CallRateLimitExceededException:
      type: object
      properties:
        message:
          type: string
    ClientException:
      type: object
      properties:
        message:
          type: string
    CvssScore:
      type: object
      properties:
        baseScore:
          type: number
          description: The CVSS base score.
        scoringVector:
          type: string
          description: The vector string of the CVSS score.
        version:
          type: string
          description: The CVSS version that generated the score.
        source:
          type: string
          description: The source of the CVSS score.
    CvssScoreAdjustment:
      type: object
      properties:
        metric:
          type: string
          description: The metric that Amazon Inspector used to adjust the CVSS score.
        reason:
          type: string
          description: The reason for the CVSS score adjustment.
    CvssScoreDetails:
      type: object
      properties:
        scoreSource:
          type: string
          description: The source for the CVSS score.
        cvssSource:
          type: string
          description: The source of the CVSS data that the Amazon Inspector score for the finding is based on, for example
            NVD or a vendor security feed.
        version:
          type: string
          description: The CVSS version that generated the score.
        score:
          type: number
          description: The CVSS score.
        scoringVector:
          type: string
          description: A vector that measures the severity of the vulnerability.
        adjustments:
          type: array
          items:
            $ref: '#/components/schemas/CvssScoreAdjustment'
          description: The adjustments that Amazon Inspector applied to the base CVSS score to produce its own score for the
            finding. The list is empty when Amazon Inspector made no adjustments.
    ForbiddenException:
      type: object
      properties:
        message:
          type: string
    ImageScanFinding:
      type: object
      properties:
        awsAccountId:
          type: string
          description: The Amazon Web Services account ID that's associated with the finding.
        imageBuildVersionArn:
          type: string
          description: The Amazon Resource Name (ARN) of the image build version that's associated with the finding.
        imagePipelineArn:
          type: string
          description: The Amazon Resource Name (ARN) of the image pipeline that's associated with the finding.
        type:
          type: string
          description: The type of the finding. Image Builder looks for findings of the type PACKAGE_VULNERABILITY that apply
            to output images, and excludes other types.
        description:
          type: string
          description: The description of the finding.
        title:
          type: string
          description: The title of the finding.
        remediation:
          $ref: '#/components/schemas/Remediation'
        severity:
          type: string
          description: The severity of the finding. For more information, see Severity levels for Amazon Inspector findings
            in the Amazon Inspector User Guide.
        firstObservedAt:
          type: string
          format: date-time
          description: The date and time when the finding was first observed.
        updatedAt:
          type: string
          format: date-time
          description: The timestamp when the finding was last updated.
        inspectorScore:
          type: number
          description: The score that Amazon Inspector assigned for the finding.
        inspectorScoreDetails:
          $ref: '#/components/schemas/InspectorScoreDetails'
        packageVulnerabilityDetails:
          $ref: '#/components/schemas/PackageVulnerabilityDetails'
        fixAvailable:
          type: string
          description: 'Details about whether a fix is available for any of the packages that are identified in the finding
            through a version update. Valid values include: YES – A fix is available for all of the packages identified in
            the finding. NO – No fix is available. PARTIAL – A fix is available for some, but not all, of the packages identified
            in the finding.'
    ImageScanFindingsFilter:
      type: object
      properties:
        name:
          type: string
          description: 'The name of the image scan finding filter. Filter names are case-sensitive. Valid filter names are:
            imageBuildVersionArn – Filters findings by the image build version that was scanned. imagePipelineArn – Filters
            findings by the pipeline that created the scanned image. vulnerabilityId – Filters findings by vulnerability ID,
            for example a CVE ID. severity – Filters findings by severity level.'
        values:
          type: array
          items:
            type: string
          description: The filter values. Filter values are case-sensitive.
    InspectorScoreDetails:
      type: object
      properties:
        adjustedCvss:
          $ref: '#/components/schemas/CvssScoreDetails'
    ListImageScanFindingsRequest:
      type: object
      properties:
        filters:
          type: array
          items:
            $ref: '#/components/schemas/ImageScanFindingsFilter'
          description: 'An array of name value pairs that you can use to filter your results. You can use the following filters
            to streamline results: imageBuildVersionArn – Filters findings by the image build version that was scanned. imagePipelineArn
            – Filters findings by the pipeline that created the scanned image. vulnerabilityId – Filters findings by vulnerability
            ID, for example a CVE ID. severity – Filters findings by severity level. If you don''t request a filter, then
            all findings in your account are listed.'
        maxResults:
          type: integer
          description: The maximum number of items to return in a single request. If you don't specify a value, Image Builder
            returns up to 25 items. The largest page size that you can request is 100 items. A page can contain fewer items
            than the maximum, with a nextToken to continue paging.
        nextToken:
          type: string
          description: A token to specify where to start paginating. Use the nextToken value from a previously truncated response.
    ListImageScanFindingsResponse:
      type: object
      properties:
        requestId:
          type: string
          description: The request ID that uniquely identifies this request.
        findings:
          type: array
          items:
            $ref: '#/components/schemas/ImageScanFinding'
          description: The image scan findings for your account that meet your request filter criteria.
        nextToken:
          type: string
          description: The next token used for paginated responses. When this field isn't empty, there are additional elements
            that the service hasn't included in this request. Use this token with the next request to retrieve additional
            objects.
    PackageVulnerabilityDetails:
      type: object
      properties:
        vulnerabilityId:
          type: string
          description: A unique identifier for this vulnerability.
        vulnerablePackages:
          type: array
          items:
            $ref: '#/components/schemas/VulnerablePackage'
          description: The packages that this vulnerability impacts.
        source:
          type: string
          description: The source of the vulnerability information.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/CvssScore'
          description: The CVSS scores for the vulnerability in this finding, as published by the vulnerability sources. Sources
            include NVD and the operating system vendor, and scores can span CVSS versions.
        relatedVulnerabilities:
          type: array
          items:
            type: string
          description: Vulnerabilities that are often related to the findings for the package.
        sourceUrl:
          type: string
          description: A link to the source of the vulnerability information.
        vendorSeverity:
          type: string
          description: The severity that the vendor assigned to this vulnerability type.
        vendorCreatedAt:
          type: string
          format: date-time
          description: The date and time when this vulnerability was first added to the vendor's database.
        vendorUpdatedAt:
          type: string
          format: date-time
          description: The date and time when the vendor last updated this vulnerability in their database.
        referenceUrls:
          type: array
          items:
            type: string
          description: Links to web pages that contain details about the vulnerabilities that Amazon Inspector identified
            for the package.
      required:
      - vulnerabilityId
    Remediation:
      type: object
      properties:
        recommendation:
          $ref: '#/components/schemas/RemediationRecommendation'
    RemediationRecommendation:
      type: object
      properties:
        text:
          type: string
          description: The recommended course of action to remediate the finding.
        url:
          type: string
          description: A link to more information about the recommended remediation for this vulnerability.
    ServiceException:
      type: object
      properties:
        message:
          type: string
    ServiceUnavailableException:
      type: object
      properties:
        message:
          type: string
    VulnerablePackage:
      type: object
      properties:
        name:
          type: string
          description: The name of the vulnerable package.
        version:
          type: string
          description: The version of the vulnerable package.
        sourceLayerHash:
          type: string
          description: The source layer hash of the vulnerable package.
        epoch:
          type: integer
          description: The epoch of the vulnerable package.
        release:
          type: string
          description: The release of the vulnerable package.
        arch:
          type: string
          description: The architecture of the vulnerable package.
        packageManager:
          type: string
          description: The package manager of the vulnerable package.
        filePath:
          type: string
          description: The file path of the vulnerable package.
        fixedInVersion:
          type: string
          description: The version of the package that contains the vulnerability fix.
        remediation:
          type: string
          description: The code to run in your environment to update packages with a fix available.
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/3cd98287b471c106254abd89279cc87308d38bfd/models/imagebuilder/service/2019-12-02/imagebuilder-2019-12-02.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)