Amazon Inspector

Amazon Inspector is an automated security assessment service that helps identify vulnerabilities and unintended network exposure in supported AWS compute resources and container images. It operates by analyzing software packages, configuration, and supported metadata, and then producing prioritized findings. It normally fits into an AWS security posture and vulnerability management architecture as a source of findings for triage and remediation workflows.

🗂 Resource Category

Security, Identity, and Compliance • Management and Governance

🧠 Exam Memory Hook

Think: "Identify CVEs in instances and images + send findings to central triage = Amazon Inspector"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and patches the underlying service platform, control plane, and the physical infrastructure that runs Amazon Inspector; AWS provides the analysis engines, rule packages, and the managed APIs used to run assessments and generate findings. AWS secures the service control plane and maintains the managed runtime, availability, and scaling of the Inspector service itself. AWS does not patch customer guest operating systems, application runtimes, or customer-managed compute resources as part of Inspector.

Customer responsibilities: The customer configures assessment targets, assessment schedules, permission boundaries (IAM), and what resources or registries to assess; the customer is responsible for deploying any required agents or enabling supported integrations, reviewing Inspector findings, prioritising them, and implementing remediation. The customer must monitor findings, integrate them into ticketing or automation pipelines if desired, and maintain the security posture of their instances, container images, and applications.

Patching responsibilities: AWS patches the physical infrastructure and the managed Inspector service platform (control plane and analysis engines). For workloads running on Amazon EC2, AWS patches the physical infrastructure and hypervisor, while the customer patches the guest operating system, installed runtimes, libraries, dependencies, and customer applications. Inspector is a detection and assessment service and does not apply patches to affected resources; remediation and patching of assessed resources are the customer's responsibility (which can be automated using other AWS tools).

🏗 Typical Architecture

💡 Top 5 Features

Automated vulnerability scanning of supported compute resources and container images
Produces prioritized findings with severity, CVE references, and remediation guidance
Supports scheduled and on-demand assessments
Integration with AWS services such as AWS Security Hub and Amazon EventBridge for centralised workflow
Ability to export and aggregate findings for triage and reporting

✅ Top 5 Use Cases

Identify and prioritise missing OS and package vulnerabilities across an EC2 fleet to plan patching windows
Scan container images in Amazon ECR as part of a CI/CD pipeline to prevent vulnerable images being deployed
Continuously assess compute resources to feed security operations and vulnerability management workflows
Aggregate Inspector findings into AWS Security Hub for centralised triage and compliance reporting
Trigger automated ticketing or remediation workflows via EventBridge when high-severity findings appear

🏗 Architecture Placement

Amazon Inspector is a regional assessment service that evaluates supported compute resources and container images and produces findings. It normally receives data through integrations or agents from EC2 instances and metadata from container registries, and it publishes findings to services such as Amazon EventBridge and AWS Security Hub for downstream processing. Inspector sits alongside logging, monitoring, and configuration services in the security and management layer. The service is used as a detection and reporting component; remediation is performed using separate tools or automation.

🎯 Commonly Used With

- AWS Security Hub
- AWS Systems Manager
- Amazon ECR
- Amazon CloudWatch
- Amazon EventBridge

🌍 5 Real-World Examples

A financial services team scans EC2 instances to discover vulnerable packages before quarterly compliance reviews and feeds findings into their security operations centre for remediation.
A retail CI/CD pipeline scans container images in Amazon ECR and blocks promotion of images with high-severity findings to production.
A healthcare operations team runs continuous assessments to identify configuration drift and software vulnerabilities prior to patient-data handling workloads going live.
A media company aggregates Inspector findings into Security Hub and uses EventBridge rules to create tickets for critical vulnerabilities in production render nodes.
A government IT team uses Inspector findings in audit reports to demonstrate discovered vulnerabilities and the actions taken to remediate them.

🎓 AWS Exam Clues

Use when you need automated vulnerability discovery and prioritized findings for compute resources and container images
Findings are integrated into AWS Security Hub and can be routed via Amazon EventBridge for automation
Inspector detects and reports issues but does not remediate or patch assessed resources natively
The service operates regionally and assesses resources within the account and region when configured
Requires customer configuration of assessment targets, permissions, and any required agents or integrations

📝 Quick Revision

Amazon Inspector performs automated security assessments to find vulnerabilities and unintended exposure in supported compute resources and container images. Use it to generate prioritized findings and integrate with Security Hub or EventBridge for triage; note that remediation and patching remain the customer's responsibility and may be automated with other services.

🏷 Keywords

vulnerability assessment • image scanning • CVE • findings • severity • Security Hub • EventBridge • AWS Systems Manager • ECR scanning • EC2 assessment • scheduled assessments • prioritised findings