Microsoft Defender for Cloud
Cloud and workloadsAgentless Data Collection
In brief
When 250 or more Defender-tagged snapshots accumulate because deletion authorization fails, new scans are suspended for the affected AWS scanning scope to limit additional storage charges.
What Defender admins need to know
Monitor deletion authorization failures because reaching this threshold can stop new scans in the affected AWS scope.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Resources | arn:aws:ec2:::snapshot/ | | Effect | Allow |
In order to limit additional storage charges, deletion authorization failures with 250 or more accumulated Defender-tagged snapshots suspend new scans for the affected AWS scanning scope.
| Attribute | Value |
|---|---|
| SID | VmScannerAccess |
@@ -113,6 +113,8 @@ The role **VmScanner** is assigned to the scanner when you enable agentless scan | Resources | arn:aws:ec2:::snapshot/ |
| Effect | Allow |
+In order to limit additional storage charges, deletion authorization failures with 250 or more accumulated Defender-tagged snapshots suspend new scans for the affected AWS scanning scope.
+
| Attribute | Value |
| --- | --- |
| SID | **VmScannerAccess** |