1. What is Inspector?

Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure.

Core Concept Inspector = automated vulnerability scanning. It scans EC2 instances, container images in ECR, and Lambda functions for known vulnerabilities (CVEs) and network reachability issues. Findings are prioritized by risk score. No agents needed for most scans (uses SSM Agent for EC2).

2. What Inspector Scans

3. Key Features

  1. Continuous scanning: automatic re-scan when new CVEs are published, or resources change
  2. Risk-based prioritization: Inspector Score (0–100) considering exploit availability, network exposure, and CVSS
  3. No manual scheduling needed: scans are event-driven and continuous
  4. Software Bill of Materials (SBOM): export a complete inventory of packages per resource
  5. Findings sent to: Inspector Console, Security Hub, EventBridge
  6. Multi-account via Organizations (delegated administrator)

4. Inspector vs GuardDuty

4. When to use

Use Inspector when you need to automatically scan AWS workloads for software vulnerabilities and unintended network exposure.

Common scenarios:

  1. Vulnerability management — Continuously scan EC2, Lambda, and ECR container images for known CVEs.
  2. Patch compliance — Identify missing OS and software patches.
  3. Network exposure — Find EC2 instances with unintended open ports or public accessibility.
  4. Container security — Scan Docker images in ECR for vulnerabilities before deployment.
  5. CI/CD integration — Scan images in the build pipeline before pushing to production.
  6. Compliance — Demonstrate ongoing vulnerability assessment for audit requirements.
Exam Tip Inspector: "Vulnerability scanning" = Inspector. "Scan EC2 for CVEs" = Inspector. "Scan ECR images for vulnerabilities" = Inspector (also ECR Enhanced Scanning uses Inspector). "Scan Lambda dependencies" = Inspector. Proactive (find before exploit). GuardDuty = reactive (detect during exploit). The inspector needs SSM Agent on EC2.