Amazon Inspector

Inspector is AWS's automated vulnerability scanning service. It continuously scans EC2 instances, container images in ECR, and Lambda functions for known software vulnerabilities (CVEs) and unintended network exposure, then surfaces the findings with severity scores and remediation guidance.

The Problem It Solves

Software has vulnerabilities. The Linux kernel, OpenSSL, Apache, and the third- party libraries your application uses all have known CVEs (Common Vulnerabilities and Exposures) that are discovered and published regularly. Knowing which of your running workloads are affected — and how severely — is an operational challenge at scale. Inspector automates this assessment continuously, so you always have an up-to-date picture of your vulnerability posture.

What It Scans

EC2 instances — Inspector uses the SSM Agent to inventory the packages installed on each instance and compares them against vulnerability databases. It also analyzes security group rules to flag instances that are unintentionally reachable from the internet on sensitive ports.

ECR container images — when you push a new image to Elastic Container Registry, Inspector automatically scans it for vulnerabilities in the base OS packages and application libraries. Findings appear in the ECR console alongside the image, before it's ever deployed.

Lambda functions — Inspector scans the Lambda deployment package for vulnerable library dependencies, helping you catch issues in serverless workloads that traditional agent-based scanners can't reach.

Findings and Prioritization

Inspector assigns each finding a risk score that combines the CVE severity with your specific environment context — whether the affected instance is internet- facing, whether there's a known exploit in the wild, and how the vulnerability could be attacked. This contextual scoring helps you prioritize which findings to remediate first rather than treating all HIGH-severity CVEs equally.

Inspector vs GuardDuty

Inspector finds vulnerabilities — known weaknesses in software that could be exploited. GuardDuty detects active threats — evidence that something malicious is happening right now. Run both: Inspector reduces your attack surface, GuardDuty detects when attackers find what's left.