AWS Inspector 2

I believe yes, AWS Inspector 2 scans can be considered as authenticated internal scans to satisfy the PCI DSS 4.0 requirement 11.3.1.2, provided they meet certain criteria. PCI DSS 4.0 requirement 11.3.1.2 mandates authenticated internal vulnerability scans, which means the scans must use privileged credentials to access and assess internal systems.

To ensure AWS Inspector 2 scans meet this requirement, you should:

• Use Privileged Credentials: Configure AWS Inspector 2 to use credentials that have sufficient privileges to access and scan internal systems.

• Document Exceptions: If there are systems that cannot accept credentials, document these exceptions and account for them in your scanning process.

• By configuring AWS Inspector 2 to perform authenticated scans with the necessary privileges, you can satisfy the PCI DSS 4.0 requirement 11.3.1.22.

Reference: https://www.rapid7.com/blog/post/2024/02/20/explanation-of-new-authenticated-scanning-pci-dss-requirement-11-3-1-2-in-pci-dss-v4-0-and-how-insightvm-can-help-meet-the-requirement/?form=MG0AV3