In Inspector Code Security, connected, launched scan, status still shows as Inactive

Question

I am trying Inspector Code Security
Connected a GitHub repo with several projects. Those projects show up in the Code Security repository list. 
I selected each and clicked on 'On-demand Scan'. A message at the top of the page stated that a scan had been initiated.
I checked back a while later and the status for the repo was still Inactive, and the Last On Demand Scan field was blank.

How do I activate a repo and get a scan to run?

tspitzer · Accepted Answer

I was told my support that 'Inactive' means that no scheduled scans have been defined. On demand scans are working.

tspitzer · Answer

from the CLI I can start a scan

E:\>aws inspector2 start-code-security-scan --resource projectId="project-c8aec74b-783d-4138-860c-ad428cfca2e8"
{
    "scanId": "a807ea11-5c44-49a2-8785-9a223c25acc9",
    "status": "IN_PROGRESS"
}

However the project still shows as inactive
![Enter image description here](/media/postImages/original/IM8JxKB7EAQAiUtTXHcnFy0g)

How do I make it active?

re:Post Agent · Answer

To properly activate and run a scan on your GitHub repository using Amazon Inspector Code Security, follow these steps:

1. First, ensure that you've properly activated the Code Security scan type in Amazon Inspector. When you activate Code Security, Amazon Inspector begins scanning your code repositories based on your scan configurations. You can verify this activation in the Amazon Inspector console.

2. After connecting your GitHub repository, you need to create and apply a scan configuration to determine how and when your repository will be scanned. The "Inactive" status suggests that while your repositories are connected, they may not have a proper scan configuration applied.

3. For your on-demand scan, after clicking "On-demand Scan," verify that the scan was actually initiated by checking the "Code repositories" tab. You should see information about how many repositories are being scanned.

4. Amazon Inspector allows you to choose different scan types for repositories:
- On-demand: Initiates an immediate scan
- Change-based: Initiates a scan on push to main branch or on pull/merge requests
- Scheduled: Initiates scans weekly or monthly

5. If your repositories remain in an "Inactive" state despite initiating an on-demand scan, you may need to:
- Check if you have the proper permissions to run scans
- Verify that your scan configuration is properly set up
- Ensure that the repository is properly connected and accessible to Amazon Inspector

You can view, edit, or create new scan configurations at any time through the Amazon Inspector console. Make sure your repositories have the appropriate scan configuration applied to activate them for scanning.  
**Sources**  
[Amazon Inspector Code Security - Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/code-security-assessments.html)  
[Activating a scan type - Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/activate-scans.html)  
[Beyond compute: Shifting vulnerability detection left with Amazon Inspector code security capabilities | AWS Security Blog](https://aws.amazon.com/blogs/security/shifting-vulnerability-detection-left-with-amazon-inspector-code-security-capabilities/)

In Inspector Code Security, connected, launched scan, status still shows as Inactive

Add your answer

Relevant content