Inspector
Amazon Inspector is a vulnerability scanner for what is already running: EC2 instances, container images in ECR and Lambda functions. The platform has it built and delegated to core-security, switched off by default for cost.
What it does
Inspector inventories the software packages inside an instance, image or function and compares them with known vulnerabilities (CVEs). It also checks EC2 instances for unintended network reachability. It runs continuously: a new image pushed to ECR is scanned on arrival and rescanned when new CVEs are published. Each issue becomes a finding with a severity and, where one exists, the fixed package version. In an organization, a delegated administrator account enables scanning for every member and sees all findings.
How BuiltForProd uses it
Inspector is controlled by two lines in environments/core/security/security.hcl:
enable_inspector = false # @optional: Inspector vulnerability scanning
inspector_scan_types = ["EC2", "ECR", "LAMBDA"] # @optional: resource types Inspector scans
Unlike GuardDuty, Inspector has no service-only step, so the order is two steps: the inspector-delegation unit in core-root names core-security as administrator, then the inspector unit in core-security (module modules/inspector2) enables scanning for the listed resource types across every core and platform account, with org_auto_enable.inspector turning on automatic enrollment of members. When the switch is off, nothing is created and nothing is billed.
The switch file records the prices beside the switch: about $1.26 per EC2 instance per month, about $0.09 per container image scanned, and about $0.30 per Lambda function per month. The platform's own compute is small and mostly managed, so the design decisions leave Inspector as an opt-in for organizations whose compliance framework asks for runtime vulnerability scanning.
When it is on, Security Hub imports its findings through the Inspector product integration, which follows the same enable_inspector switch. The scanned targets would be the EKS worker nodes and optional self-hosted runners (EC2), the acme-aws-blueprint-webapp and acme-aws-blueprint-etl-lambda repositories in ECR, and the ETL trigger function (Lambda).
Inspector is not the only scanner. Before an image reaches ECR, the code repositories' CI runs a Trivy image scan that fails on fixable HIGH and CRITICAL CVEs, and ECR itself scans on push. Inspector adds continuous rescanning after deployment.
Terms you will see
| Term | Meaning |
|---|---|
| CVE | A published identifier for a known software vulnerability. |
| Finding | One vulnerability or reachability issue on one resource. |
| Scan type | The resource class Inspector covers: EC2, ECR or LAMBDA. |
| Delegated administrator | The account that manages Inspector for the organization; core-security. |
| Auto-enable | The organization setting that scans new member accounts automatically. |
| Network reachability | The EC2 check for ports reachable from outside the VPC. |
Where to read more
- AWS Baseline overview for the security services and their defaults.
- ECR for the image repositories Inspector would scan.
- Checkov, Trivy and tflint for the scans that run before merge.