Amazon Inspector

Amazon Inspector is a vulnerability management service. It discovers eligible workloads automatically and scans them continuously for known software vulnerabilities (CVEs) and unintended network exposure, producing findings with remediation guidance. There are no assessment templates to schedule and no assessment runs to start.

Inspector rescans a resource whenever something changes that could introduce a vulnerability — a package is installed, a patch is applied, a new image is pushed, or a new CVE that affects the resource is published. When a finding is remediated, Inspector detects that and closes it.

Scan types

• Amazon EC2 scanning — CVEs in operating system and programming language packages, plus network reachability and unintended network exposure. Coverage comes either from the SSM Agent on the instance or from agentless scanning of EBS snapshots; hybrid mode, which uses whichever applies, is the default.
• Amazon ECR scanning — enhanced scanning of container images in a private registry, on push and on a continuing basis afterwards.
• AWS Lambda standard scanning — the default. Scans the application package dependencies of a function and its layers for package vulnerabilities, on deployment, on update and when new CVEs are published.
• AWS Lambda code scanning — an optional addition that scans the custom application code in a function and its layers for code vulnerabilities. Standard scanning must be active first.
• Code Security for Amazon Inspector — scans first-party application code, third-party dependencies and infrastructure as code.

Scoring and integration

Findings carry an Amazon Inspector risk score: the NVD base score adjusted for the environment. A vulnerability that is exploitable over the network scores lower on an instance with no open network path from the internet, so the ranking reflects real exposure rather than the raw CVSS number.

Inspector publishes findings to Amazon EventBridge as events, and to AWS Security Hub CSPM when that is enabled. In a multi-account estate, one account is designated the delegated administrator through AWS Organizations; it activates and deactivates scanning for members and sees aggregated findings across the organisation.

Amazon Inspector Classic

The original Amazon Inspector — with network assessments, host assessments, assessment templates and a per-instance Inspector agent — was a different service, now called Amazon Inspector Classic. AWS ended support for it on 20 May 2026, after which its console and resources are no longer accessible; its user guide remains published as an archive. Nothing in the current service corresponds to it: there is no agent to install for Inspector itself (the SSM Agent serves that purpose), no assessment to configure, and no split between network and host assessments. Guidance that mentions “the Inspector agent” or “assessment targets” refers to the retired service.