Integrate Your AssetsCloudAWSServerless
AWS Serverless Integration Release Notes
Changes to the Lambda function and CloudFormation template in each release of the Mondoo serverless AWS integration.
This page lists user-visible changes in each release of the Mondoo serverless AWS integration. Each release covers two parts:
- Lambda: The Mondoo Lambda function that runs the scans. The Mondoo Updater Lambda installs new Lambda builds automatically, so you don't need to take any action for these changes.
- CloudFormation template: The template that creates the stack, roles, and permissions in your AWS account. Template changes reach your account only when you update the stack. To learn how updates work, read Updates.
v2.97.0
Released November 10, 2026
Lambda
- Cross-account EBS scans (beta) now re-encrypt snapshots onto a KMS key in the hub account, one per region, instead of a key in each target account. To keep scanning encrypted volumes, update the hub stack and then the cross-account role StackSet. Until you do, encrypted volumes in target accounts are skipped, and the integration shows a warning. Unencrypted volumes are scanned as before.
- Fixes the hub running more account scans than its concurrency limit at the start of a scan cycle.
- Internal scheduling improvements and dependency updates.
CloudFormation template
- Allows the Lambda role to create and manage the
alias/mondoo-ebs-scanKMS keys in the hub account when cross-account scanning is on. - The cross-account role template no longer creates a KMS key in the target account, and uses the hub's key only through EC2. A key that an earlier template created stays in the target account; schedule its deletion with
aws kms schedule-key-deletiononce no Mondoo snapshots remain.
v2.96.0
Released November 7, 2026
Lambda
- Fixes scans finishing late when a service control policy denies EventBridge in some regions.
v2.95.0
Released November 6, 2026
Lambda
- Fixes stack creation failing when the Lambda can't create its event rules on the
mondooevent bus, for example because a service control policy deniesevents:TagResource. Installation now continues, and the hourly sync job keeps trying to create the rules. - Dependency updates.
v2.94.0
Released November 6, 2026
Lambda
- Internal code improvements and release tooling changes.
v2.93.0
Released November 5, 2026
Lambda
- Internal code improvements.
v2.92.0
Released November 5, 2026
Lambda
- Reports the version of the CloudFormation template the stack was last deployed or updated with to Mondoo on each check-in, next to the Lambda version. Because the Lambda updates itself without a stack update, the two can differ, and Mondoo can now tell when a stack's template is behind.
CloudFormation template
- Records its release version as
Mondoo::TemplateVersionin the template metadata and passes it to the Lambda as theMONDOO_TEMPLATE_VERSIONenvironment variable. A stack deployed from an earlier template reports no template version until you update the stack. - The cross-account role template records the same version in its metadata and as the
mondoo:template-versiontag on the role.
v2.91.0
Released November 4, 2026
Lambda
- Scheduled jobs move from EventBridge rules to EventBridge Scheduler once you update the stack. The first scan after the switch can run up to one interval late.
- Fixes cross-account EBS scans (beta) skipping encrypted volumes on a new target account's first run.
- Fixes a TLS handshake timeout in Windows scans.
- Speeds up VPC cleanup when you delete the stack.
- Dependency updates and internal code improvements.
CloudFormation template
- Adds the
mondooEventBridge Scheduler schedule group and themondoo-scheduler-rolerole, which can only invoke the Mondoo Lambda. - Allows the Lambda role to manage schedules in the
mondoogroup and to passmondoo-scheduler-roleto EventBridge Scheduler.
v2.90.1
Released October 28, 2026
Lambda
- Fixes missing per-platform EC2 instance counts for accounts with instances in several regions.
- Speeds up resource discovery in accounts without EC2 instances.
v2.90.0
Released October 28, 2026
Lambda
- New (beta): With cross-account scanning, Mondoo can now scan the EC2 instances in your target accounts through EBS snapshots. To try it, contact Mondoo.
- EBS volume scans now include an instance's data volumes, not only its root volume. Windows instances are still scanned from the root volume only.
- EC2 instance and ECR assets now carry the
mondoo.com/aws-account-idannotation, so you can filter and group assets by AWS account. - Dependency updates and internal code improvements.
CloudFormation template
- Adds the hub account permissions that the beta EBS scanning of target accounts needs.
- The cross-account role template adds the
EbsScanningparameter,trueby default, so updating your StackSet to this template lets the role snapshot EBS volumes, including encrypted ones, and share the snapshots with the hub account. Mondoo uses these permissions only once the beta is on for your integration; setEbsScanningtofalseto keep the role read-only. - Tightens several IAM policy statements and limits Elastic IP cleanup to addresses that Mondoo created.
- Fixes a failure when you delete the stack and deploy it again in the same account and region, caused by a leftover Lambda log group.
v2.89.0
Released October 7, 2026
Lambda
- New: Account scans now use the integration's Discovery targets setting, so you can choose which AWS resource types an account scan discovers. Integrations that don't set it discover the same resources as before.
- Prepares for scans to install cnspec from the Mondoo cache bucket in each region instead of from install.mondoo.com, which will cut the scan traffic that passes through NAT gateways. Scans don't use it yet, but you may see cnspec files in the cache bucket.
- Updates the scanning engine to cnspec v14.
- Improved error messages.
- Dependency updates and internal code improvements.
v2.88.0
Released October 1, 2026
Lambda
- Scans no longer fail when AWS has no capacity for the scanner instance type in an availability zone. The scanner now tries other instance types and, if you use a custom VPC, the other tagged subnets in that VPC.
- Failed Windows scans, both EBS volume scans and scans through AWS Systems Manager (SSM), now show as failed instead of successful. You may see more failed Windows scans than before.
- Improved error messages.
- Dependency updates and internal code improvements.
CloudFormation template
- Allows the scanner to launch on the
t2.large,t3.medium,t3.large,t3a.medium,t3a.large, andt4g.largeinstance types, so it can fall back to them when AWS is out of capacity. Until you update the stack, the scanner only falls back to the instance types your stack already allows.
v2.87.0
Released September 18, 2026
Lambda
- New: The serverless scanner can now discover and scan accounts in additional AWS Organizations, not only the organization of the hub account. It reuses the cross-account scan roles you already deployed, so no new roles or trust changes are needed.
- Dependency updates and internal code improvements.
CloudFormation template
- Adds the role permissions needed to scan accounts in additional AWS Organizations.
- Removes Lambda permissions the scanner no longer uses.
v2.86.0
Released September 10, 2026
CloudFormation template
- Removes the deprecated
CustomTag1Key,CustomTag1Value,CustomTag2Key, andCustomTag2Valueparameters. To tag the resources Mondoo creates, add tags to the CloudFormation stack instead. - The AWS console now groups the template parameters, listing the required Mondoo integration parameters first.
v2.84.0
Released September 8, 2026
Lambda
- Scan status messages for new EC2 instances now include the instance ID, so you can tell apart instances that are unnamed or share a name.
- Dependency updates and internal code improvements.
v2.83.0
Released September 4, 2026
Lambda
- Account scans in large environments are now spread out over time instead of starting all at once. This reduces failed scans when many accounts are scanned together.
- Dependency updates and internal code improvements.
v2.81.0
Released September 1, 2026
Lambda
- New: Scan schedules can now run at a specific time of day or on specific days of the week, in addition to a fixed interval in hours.
v2.80.0
Released August 29, 2026
Lambda
- Updates the scanning engine to cnspec v13.36.0.
- Dependency updates and internal code improvements.
v2.79.0
Released August 28, 2026
Lambda
- Fixes EC2 instances scanned through AWS Systems Manager (SSM) losing their
mondoo.com/scan-typelabel between scans. - Internal code improvements.
v2.78.0
Released August 27, 2026
Lambda
- When no scan interval is configured, scans now run every 24 hours instead of every 6 hours.
- Account scans now scan fewer EC2 instances in parallel, which improves reliability.
- Internal code improvements.
CloudFormation template
- Adds an optional
MondooSourceBucketparameter for the S3 bucket the Lambda code is deployed from. Mondoo fills it in when it generates the stack. - Fixes automatic updates switching the Lambda from x86_64 to arm64 in regions where it runs on x86_64.
v2.77.2
Released August 27, 2026
- Internal improvements to release tooling. No changes to the Lambda or the CloudFormation template.
v2.77.1
Released August 25, 2026
- Internal improvements to release tooling. No changes to the Lambda or the CloudFormation template.
v2.77.0
Released August 24, 2026
Lambda
- Dependency updates.
v2.76.0
Released August 24, 2026
Lambda
- Reports the pinned version, if one is set, to Mondoo.
CloudFormation template
- New: Adds an optional
FixedVersionparameter that pins the Lambda to a specific release. When it's set, the Mondoo Updater Lambda isn't deployed and the Lambda doesn't update automatically. Clear the parameter to return to automatic updates.