Amazon Inspector
Automated vulnerability management: continuous scanning of EC2 instances (agent-based with SSM, agentless with EBS snapshots, hybrid by default), container images in ECR, and Lambda functions, for software vulnerabilities and network exposure, the Inspector risk score, findings, reports, multi-account management, and how it differs from GuardDuty.
3 min read · Last reviewed · SAA-C03
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
Amazon Inspector is a vulnerability management service that automatically discovers workloads and continually scans them for software vulnerabilities (such as known CVEs) and unintended network exposure. It scans:
- Amazon EC2 instances.
- Container images in Amazon ECR.
- AWS Lambda functions.
When it finds an issue, it creates a finding with details and a risk score.
Choose Inspector when a question asks to find unpatched software or known vulnerabilities, scan container images, or check whether instances are reachable from the internet on risky ports.
How scanning works
- EC2 instances:
- Agent-based scanning collects software inventory using the Systems Manager (SSM) Agent.
- Agentless scanning uses EBS snapshots instead.
- New accounts start in hybrid scanning, which uses both.
- ECR container images: Inspector provides ECR enhanced scanning; whether a repository uses basic or continuous scanning is configured in ECR.
- Lambda functions: standard scanning checks dependencies in functions and layers for package vulnerabilities; code scanning checks your custom code for code vulnerabilities.
- Inspector score: for EC2 findings, Inspector adjusts the CVSS base score using your environment, such as network reachability, to prioritize what matters most.
- Findings and reports: manage findings in the console or API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, export reports, and send findings to EventBridge and Security Hub.
- Multi-account: with AWS Organizations, a delegated administrator manages Inspector for all accounts.
Security, resilience, performance, and cost
- Security: continuous scanning catches newly published vulnerabilities on existing workloads; combine with Systems Manager Patch Manager to fix them.
- Cost: pay for what is scanned, such as EC2 instances, container images, and Lambda functions, with no minimum fees; new accounts get a 15-day free trial.
Inspector or another option?
| If the requirement is | Choose |
|---|---|
| Find CVEs in EC2 software, container images, or Lambda | Amazon Inspector |
| Find instances reachable from the internet on risky ports | Amazon Inspector network reachability |
| Detect active threats and compromised resources | Amazon GuardDuty |
| Apply missing patches | Systems Manager Patch Manager |
| Configuration compliance rules | AWS Config |
Reverse mindmap: when the question points here
- Yes, when the question says
- Scan EC2 instances for software vulnerabilities leads to Inspector
- Scan container images in ECR leads to Inspector
- Vulnerabilities in Lambda packages or code leads to Inspector Lambda scanning
- Instances exposed to the internet leads to Network reachability findings
- Know how it scans
- With the SSM Agent leads to Agent-based scanning
- Without an agent leads to Agentless scanning with EBS snapshots
- Prioritize findings leads to Inspector score
- No, when the question says
- Detect active attacks leads to GuardDuty
- Install the patches leads to Patch Manager
Key takeaways
- Inspector continually scans EC2, ECR images, and Lambda for software vulnerabilities and network exposure.
- EC2 scanning is agent-based (SSM Agent), agentless (EBS snapshots), or hybrid by default.
- The Inspector score adjusts CVSS with context such as network reachability.
- Findings go to the console, EventBridge, and Security Hub; Organizations integration covers all accounts.
- GuardDuty finds threats; Inspector finds vulnerabilities.
Sources
- Amazon Inspector User Guide: What is Amazon Inspector?
- Amazon Inspector User Guide: Scanning Amazon EC2 instances
- Amazon Inspector User Guide: Scanning ECR container images
- Amazon Inspector User Guide: Scanning AWS Lambda functions
- Amazon Inspector User Guide: Inspector score and vulnerability intelligence
- Amazon Inspector User Guide: Exporting findings reports
- Amazon Inspector pricing