Automated Vulnerability Scanning with Amazon Inspector - Continuous Security Assessment for EC2, Lambda, and ECR
Automatically scans EC2 instances, ECR container images, and Lambda functions for vulnerabilities and prioritizes them with CVE-based risk scores. Explains how agentless scanning is also achieved through integration with the Systems Manager agent.
Overview of Inspector
Amazon Inspector is a security assessment service that automatically scans EC2 instances, ECR container images, and Lambda functions for vulnerabilities. Inspector v2 is a redesign of v1, and when you enable it, it automatically discovers target resources and scans them continuously. It checks against the CVE (Common Vulnerabilities and Exposures) database and assigns a risk score (the Inspector score) to each detected vulnerability. The Inspector score is a proprietary contextual score that takes network reachability and the availability of exploits into account in addition to the CVSS base score, which makes prioritization based on actual risk possible. While GuardDuty specializes in runtime threat detection, Inspector focuses on detecting vulnerabilities in advance.
Scan Targets and Detection Methods
Scans of EC2 instances run through the Systems Manager (SSM) agent. Instances with the SSM agent installed automatically become scan targets, and Inspector detects vulnerabilities in OS packages (Amazon Linux, Ubuntu, Windows, and others). Agentless scanning is also offered, which makes EBS snapshot-based scanning possible without the SSM agent. Scans of ECR container images run when an image is pushed and through periodic rescans. In addition to the OS packages of the base image, Inspector also detects vulnerabilities in programming language packages (npm, pip, Maven, and others). Scans of Lambda functions run at deployment and periodically, and they detect vulnerabilities in the packages that the function code depends on.
Managing Findings and Integrations
Detected vulnerabilities are listed on the dashboard of the Inspector console, which presents the risk score, the affected resources, and how to remediate them. With suppression rules, you can hide vulnerabilities that you have already accepted and false positives, and focus on the vulnerabilities that need action. Through integration with Security Hub, you manage Inspector findings together with the findings of other security services (GuardDuty, Macie, Config) in an integrated way. Through integration with EventBridge, you can trigger SNS notifications or Lambda functions when a Critical or High vulnerability is detected and build automated remediation workflows. Through integration with Organizations, you centrally manage Inspector for all member accounts from a delegated administrator account and visualize the vulnerability status of the entire organization.
Inspector Pricing
Inspector pricing differs by the type of resource being scanned. Scans of EC2 instances are billed according to the number of target instances. ECR container images are billed separately for the initial scan and for rescans. Scans of Lambda functions are billed according to the number of target functions. As a free trial, you can use all features free of charge for 15 days after enabling the service. When you enable it for all accounts at once through Organizations, you estimate in advance the cost based on the number of accounts × the number of resources.
How Continuous Scanning Works
A defining feature of Inspector is that it assesses vulnerabilities continuously rather than only once. When a new package is installed or new vulnerability information is published, Inspector detects it and automatically rescans. This keeps assessment results up to date and makes it easier to notice newly discovered risks. It identifies the software configuration information contained in container images and instances and checks it against known vulnerabilities. Unlike an operation in which you run scans manually on a regular basis, assessment happens automatically when a change occurs, so you can reduce delays in response. Continuous visibility becomes the foundation of security operations.
Prioritizing Risk
Because vulnerabilities are found one after another, responding to all of them with the same priority is not realistic. Inspector shows the priority of risks with a score that considers context, such as whether a vulnerability can actually be exploited and whether the asset is reachable over the network, in addition to the severity of the vulnerability. This lets you address problems that can realistically be attacked ahead of problems that have high theoretical severity but cannot actually be reached. You can concentrate limited response resources on the items with high risk. Prioritizing with context in mind makes it easier to decide the order of response.
Remediation and Operations
Detected vulnerabilities come with remediation guidance on how to address them, which makes it easier to plan your response. Many can be resolved by updating packages, so you fix them in coordination with your patching operations. Findings that you cannot address right away, or that you judge to have no impact, can be temporarily excluded with suppression rules so that you can focus on the ones that need action. However, you review them regularly so that suppressed items are not left unattended. Building the flow from detection to remediation into your operational processes and running a cycle of promptly assessing and responding when new vulnerabilities are found leads to maintaining your security level.
Organization-Wide Deployment and Governance
In organizations that operate multiple accounts, you centralize vulnerability management. Inspector has a mechanism for centralized management across the entire organization, and you can see the scan status and findings for all accounts from a management account. This lets you check across accounts which ones still have serious risks and decide response priorities at the organization level. If you aggregate findings into other security services, you can manage them in an integrated way together with a variety of security information. Instead of responding separately for each account, you can build a well-governed vulnerability management system across the entire organization.
Summary
Amazon Inspector is a security assessment service that automatically detects vulnerabilities in EC2, ECR, and Lambda and prioritizes them with context-based risk scores. It supports both SSM agent integration and agentless scanning, and through integration with Security Hub and EventBridge, it automates the workflow from detection to remediation.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon Inspector official page
- Amazon ECR official page
- AWS Security Hub official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.