Amazon Inspector
Automated, continuous vulnerability scanning for EC2 instances, ECR container images, and Lambda functions.
Verified against AWS documentation · 2026-08-26
Key facts
- 01Continuous, not scheduled — new instances, pushed images, and deployed functions are discovered and scanned automatically, then rescanned when new CVEs drop
- 02Scans three resource types: EC2 (via SSM Agent or agentless EBS-snapshot scanning), ECR images (enhanced scanning), Lambda functions and layers
- 03Finds two problem classes: software vulnerabilities (CVEs in OS and language packages) and unintended network exposure
- 04Each finding gets a risk score contextualized by environment — an internet-reachable vulnerable instance ranks above the same CVE on a private one
- 05Organization-wide: enable once via delegated admin, findings roll up to Security Hub
Exam triggers
Phrases and scenarios that point here.
- "Software vulnerabilities", "CVEs", "unpatched packages" on EC2 or containers → Inspector
- "Continuously scan container images in ECR" → Inspector enhanced scanning
- "Network reachability" / "unintended network exposure" assessment → Inspector
- Automated security assessment of workloads (not accounts, not data) → Inspector
Not this service
- Threat detection from logs/behavior (compromised credentials, crypto mining) → GuardDuty
- Finding sensitive data (PII) in S3 → Macie
- Aggregating findings across security services → Security Hub
- Account-level best-practice checks (open ports in SGs, IAM hygiene) → Trusted Advisor
Use cases
- 01A log4j-style zero-day lands overnight — Inspector rescans your whole fleet against the new CVE and surfaces every affected instance and image by morning, no scan jobs to kick off
- 02CI/CD pushes a container image to ECR and it's scanned on push, so a vulnerable base layer is flagged before the deploy pipeline promotes it
- 03A team quietly launches EC2 instances for a side project — Inspector auto-discovers them and they show up in findings without security ever knowing the instances existed
- 04Compliance audit asks 'how do you manage vulnerabilities?' — continuous scanning plus Security Hub findings history is the evidence trail
How it's charged
- 01Per resource type, metered separately: EC2 by average instances scanned per month, ECR by image scans (initial scan and rescans priced differently), Lambda by average functions scanned per month
- 02Volume-tiered — per-unit price drops as scanned resource counts grow
- 03No charge to enable across an organization; you pay only for what's actually scanned
- 0415-day free trial per account to size cost before committing
