Amazon Inspector

Service that automatically finds vulnerabilities in AWS resources.

Back to glossary Go to related practice questions

In one sentence

Service that automatically finds vulnerabilities in AWS resources.

Overview

Amazon Inspector is a security assessment service that detects vulnerabilities in EC2, container images, and Lambda.

Common use cases

EC2 vulnerability assessment
ECR image scanning
Checking Lambda dependencies

CLF-C02 exam points

A vulnerability management service
Used for security assessments
Detects different things than GuardDuty

SAA-C03 exam points

For container workloads, consider it together with ECR scanning
Aggregate findings into Security Hub
Establish a process for prioritizing remediation

Practical Use

Amazon Inspector is a managed vulnerability management service that continuously detects vulnerabilities and unexpected network reachability for Amazon EC2 instances, container images stored in Amazon ECR, and AWS Lambda functions. Once the service is enabled, target resources are automatically discovered, and software vulnerability detection based on the CVE database runs continuously. Detection results are presented with severity (Critical / High / Medium / Low / Informational) attached, and can be linked to notifications and automated responses via Security Hub or Amazon EventBridge. In ECR container image scanning, in addition to one-off scans at image push time, continuous scanning of already-registered images is possible, enabling assessment of impact scope retroactively when new CVEs are published. In Lambda function scanning, the function code and dependent libraries are subject to detection. EC2 scanning requires integration with the SSM agent, and instances without the agent installed are excluded from scanning. In the exam context, the difference in roles from GuardDuty is frequently asked. The difference is that GuardDuty "detects suspicious operations and communications in the environment", while Inspector "detects the vulnerabilities of resources themselves". In container operations, the differentiation between ECR's standard scanning (Basic scanning) and Inspector's extended scanning (Enhanced scanning) is also often asked. Pricing is usage-based according to the number of scan target resources and scan frequency. For MVPs, the common practice is to judge adoption after confirming the cost-effectiveness.

Official Documentation

Cost notes

Billed based on scan targets and usage
For MVPs, verify cost-effectiveness before adoption

Security notes

Establish an operational rule to not leave findings unaddressed
Remediate high-severity vulnerabilities first

Related services

Amazon Elastic Container Registry

Service for storing container images on AWS.

AWS Lambda

Runs code only when needed, without launching servers.

Amazon GuardDuty

Service that detects suspicious operations and signs of attack in AWS environments.

Related architecture diagrams

Related architecture diagrams have not been added for this term yet.