Amazon Inspector
Monitoring & DetectionAmazon Inspector is a vulnerability management service that automatically discovers and scans workloads for software vulnerabilities and unintended network exposure.
What It Scans
- EC2 Instances: OS packages (using SSM Agent) and network reachability
- ECR Container Images: OS packages and programming language packages in container images
- Lambda Functions: code dependencies and packages
Key Features
- Continuous Scanning: automatically re-scans when new CVEs are published or when workloads change
- Risk-based Prioritization: Inspector score combines CVSS with environmental factors (network exposure, exploit availability)
- SBOM Export: generate Software Bill of Materials for compliance
- Integration: findings go to Security Hub, EventBridge, and S3 for centralized management
- CIS Benchmarks: assess EC2 instances against CIS hardening standards
Related AWS Services
Related Terms
AWS service that aggregates security findings from GuardDuty, Inspector, Macie, and third-party tools into a single dashboard with compliance scoring.
Security practices for containerized workloads on AWS (ECS, EKS, Fargate) including image scanning, runtime security, and network policies.
Security practices for Amazon EC2 instances including IMDSv2, security groups, instance profiles, EBS encryption, and patching.
A prescriptive security configuration checklist from the Center for Internet Security that defines best practices for securing AWS accounts.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.