VM Security

VM AMI Inventory Ingestion

Use the AMI inventory scanner to discover EC2 images and ingest them through the registry ingestion pipeline for unified visibility.

Environment variables

Set BLACKSHIELD_API_URL to the API origin, such as https://api.blackshield.chaplau.com. Do not point the scanner at the console dashboard URL.

BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com
BLACKSHIELD_API_KEY=sp_xxx
AWS_REGION=us-east-1
CONNECTOR_INSTANCE=ami-prod-us-east-1
AMI_OWNER_IDS=self,123456789012
INCLUDE_DEPRECATED=false
POLLING_INTERVAL_SECONDS=0

Behavior

Discovers AMIs through EC2 DescribeImages by owner scope.
Normalizes each AMI to a registry image event with registry_type=ami.
Posts batches to /api/v1/ingest/registry-images.
Reports connector heartbeat and result telemetry for reliability monitoring.

Rollout guidance

Run in single-scan mode first to verify the connection and confirm inventory is reporting correctly.
Use periodic mode in production for drift and inventory freshness.
Pair with signature and in-toto checks for complete supply-chain posture.

VM AMI Inventory Ingestion