Amazon Inspector
Finds software vulnerabilities and exposed EC2 network paths so you can prioritize fixes
Inspector finds weaknesses in your software and helps you decide what to fix first. Think of a mechanic checking a delivery fleet against manufacturers' recall notices. A van can run perfectly and still contain a faulty part. The mechanic records which vans have it and which need attention first. A new recall means checking the list again, even if no van has changed. Inspector does this with supported software in AWS. It can also flag network settings that let people reach your servers from outside their private network. You get a list of affected systems and suggested repairs. Your team fixes them; Inspector checks again. An empty report does not prove everything is safe: some systems may not have been checked.
Amazon Inspector compares software inventories from EC2 instances, ECR images, and eligible Lambda functions with published vulnerability advisories. EC2 inventories come from agents or, in hybrid mode, EBS snapshots of eligible instances. ECR enhanced scanning covers operating-system and language packages; continuous scanning reassesses eligible images when relevant vulnerabilities are added. Optional Lambda code scanning checks application code. EC2 network reachability findings analyze network configuration rather than attempting break-ins. EC2 package scores can account for network exposure. Delegated administration centralizes workload findings, with Security Hub CSPM and EventBridge integrations.
Key Capabilities
- EC2 software-package checks using agent inventories or EBS snapshots of eligible instances
- ECR enhanced scanning for operating-system and language packages, with continuous rescans inside configured coverage windows
- Lambda dependency scanning, plus optional code scanning for flaws such as injection and weak cryptography
- Optional Code Security scanning of repository source code, dependencies, and infrastructure-as-code; findings do not flow to Security Hub CSPM
- EC2 network-path analysis and exposure-aware package scoring where supported
- Delegated administration for workload scanning, with Security Hub CSPM aggregation and EventBridge response workflows
Gotchas & Constraints
Gotcha #1: Inspector reports problems; you patch servers, rebuild images, or redeploy functions. Findings also close when scanning eligibility expires, so closed does not always mean fixed. Gotcha #2: Enabled does not mean covered. Check collection failures, unsupported systems, repository filters, and image re-scan windows. Constraints: Activate scanning per Region; feature availability varies. Lambda scanning covers eligible $LATEST functions invoked or updated within 90 days, not published versions or deployment packages encrypted with customer managed keys. Costs vary by scan type; ECR enhanced scanning is billed through Inspector.
Illustrative scenario: an online retailer operates across 12 AWS accounts and two Regions, with 80 EC2 instances and 30 ECS services. Its security team can see suspicious activity in GuardDuty but lacks a consistent inventory of vulnerable software. Using a delegated security account, the team enables Inspector across the organization in both Regions, confirms EC2 coverage, and configures production ECR repositories for continuous enhanced scanning. It checks image eligibility and re-scan windows rather than assuming every stored image is monitored. When a new advisory is added, Inspector flags a patchable library vulnerability in 18 stored images and six EC2 instances. Its image-to-container mapping shows that six affected images support six live production services. An EventBridge rule invokes a Lambda function that opens tickets for the owning teams. Developers rebuild the six live-service images with the fixed library, test them, push them to ECR, and roll out new ECS tasks. Operations patches the six EC2 instances. The team blocks redeployment of the old images and checks deployment records to confirm they are no longer running. Leaving an old image in ECR does not patch it.
The Result
within 48 hours, all six affected production services run patched images and all six affected servers are patched. Fresh scans verify the replacements; the old images remain flagged while stored and eligible for scanning.