Amazon Inspector
A security assessment service that automatically and continuously scans EC2 instances, Lambda functions, and container images for vulnerabilities
Overview
Amazon Inspector is a security service that automatically detects software vulnerabilities and network exposure in AWS workloads. It continuously scans CVEs (Common Vulnerabilities and Exposures) in EC2 instance OS packages, Lambda function dependency libraries, and ECR container image packages. When new CVEs are published, it automatically rescans existing resources and immediately identifies affected ones. Findings are classified by severity (Critical, High, Medium, Low) and can be aggregated in Security Hub for centralized management.
Three Scan Targets - EC2, Lambda, and ECR - and How Detection Works
Inspector scanning covers three distinct targets, each with its own detection mechanism. EC2 scanning collects OS package information via the SSM Agent and cross-references it against the CVE database to identify known vulnerabilities. Agentless scanning is also available, analyzing EBS snapshots to scan instances without the SSM Agent installed. Lambda scanning detects vulnerabilities in dependency libraries (Python pip, Node.js npm, etc.) included in function deployment packages. ECR scanning runs automatically on image push and when new CVEs are published. Inspector automatically discovers target resources and begins scanning upon activation, requiring no individual scan configuration.
CI/CD Pipeline Integration and Finding Triage
One practical use of Inspector is integrating it into CI/CD pipelines to catch vulnerabilities before deployment. In one such setup, Inspector automatically scans images when they are pushed to ECR, and the pipeline is halted via EventBridge when Critical or High vulnerabilities are detected. For finding triage, configuring suppression rules lets you filter out known false positives and findings that do not require action (such as EOL but isolated instances), helping reduce alert fatigue for operations teams. Prioritize remediation by combining Inspector's severity rating with the CVSS score and whether the vulnerability has a known exploit in the wild.
Security Hub Integration and Organization-Wide Vulnerability Management
Inspector findings can be aggregated in Security Hub for centralized management alongside findings from GuardDuty, Macie, and other security services. This unified view lets security teams correlate vulnerabilities with active threats - for example, identifying an EC2 instance that has both a Critical CVE and suspicious network activity flagged by GuardDuty. Organizations integration enables centralized management of Inspector across all accounts from a delegated administrator account. Microsoft Defender for Cloud offers broader scan coverage across VMs, Azure SQL, and Kubernetes clusters. According to the official AWS pricing page, Inspector is billed per scan target, based on factors such as the number of EC2 instances, Lambda functions, and container images scanned (as of October 2026; see that page for unit prices). One setup routes Inspector findings through Security Hub to Amazon Q Developer in chat applications (formerly AWS Chatbot) for Slack notifications.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon ECR official page
- Amazon GuardDuty official page
- AWS Security Hub official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.