Skip to content

Amazon Inspector

Service Overview and Purpose

Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices, providing detailed security findings with remediation guidance.

Core Purpose: - Automated vulnerability scanning and assessment - Continuous security monitoring for applications and infrastructure - Software vulnerability detection and management - Network reachability analysis - Compliance and security best practice validation

Key Features and Capabilities

Core Scanning Capabilities

  1. Amazon EC2 Instance Scanning
  2. Operating system vulnerabilities
  3. Application vulnerabilities
  4. Network reachability analysis
  5. Security configuration assessment

  6. Runtime behavior analysis

  7. Container Image Scanning

  8. ECR container image vulnerability assessment
  9. Software composition analysis
  10. Base image and layer scanning
  11. Continuous monitoring of image repositories

  12. Integration with CI/CD pipelines

  13. Lambda Function Scanning

  14. Function code vulnerability assessment
  15. Dependency vulnerability scanning
  16. Runtime security analysis
  17. Package vulnerability detection
  18. Layer-by-layer analysis

Advanced Features

  1. Vulnerability Intelligence
  2. CVE (Common Vulnerabilities and Exposures) database
  3. Real-time vulnerability feed updates
  4. CVSS scoring and prioritization
  5. Exploit prediction scoring

  6. Zero-day vulnerability detection

  7. Risk-Based Prioritization

  8. Inspector Risk Score calculation
  9. Exploitability and impact assessment
  10. Network exposure analysis
  11. Business criticality consideration

  12. Automated remediation recommendations

  13. Integration and Automation

  14. Security Hub integration
  15. EventBridge event notifications
  16. Systems Manager integration
  17. Third-party tool integration
  18. Automated reporting and dashboards

Use Cases and Scenarios

Primary Use Cases

  1. Vulnerability Management: Continuous vulnerability scanning and remediation
  2. Compliance Assessment: Meeting security compliance requirements
  3. DevSecOps Integration: Security scanning in CI/CD pipelines
  4. Risk Assessment: Understanding security risk posture
  5. Incident Response: Post-incident vulnerability analysis
  6. Security Auditing: Regular security assessment and reporting
  7. Container Security: Secure container image deployment
  8. Serverless Security: Lambda function security assessment
  9. Penetration Testing: Automated security testing
  10. Regulatory Compliance: Meeting industry security standards

Scenario Examples

  • Application Deployment: Pre-deployment vulnerability scanning
  • Production Monitoring: Continuous runtime vulnerability monitoring
  • Container Pipeline: Automated container image security validation
  • Compliance Audit: Generating security compliance reports
  • Incident Investigation: Post-breach vulnerability assessment

Pricing Models and Cost Optimization

Pricing Structure

  1. EC2 Instance Scanning
  2. $0.30 per instance per month for continuous assessment
  3. No charges for stopped or terminated instances

  4. Regional pricing variations apply

  5. ECR Container Image Scanning

  6. $0.09 per image scan for initial scan
  7. $0.01 per image re-scan for updated images

  8. Based on unique image digests

  9. Lambda Function Scanning

  10. $0.30 per function per month for continuous assessment
  11. No charges for unused or deleted functions
  12. Based on active function versions

Cost Optimization Strategies

  1. Selective Scanning: Target critical resources for scanning
  2. Scheduled Scanning: Optimize scanning frequency for non-critical resources
  3. Image Lifecycle: Manage container image lifecycle to reduce scan costs
  4. Resource Tagging: Use tags for cost allocation and optimization
  5. Regional Deployment: Deploy in cost-effective regions
  6. Integration Efficiency: Minimize duplicate scanning through automation

Configuration Details and Best Practices

Inspector Configuration

{
  "AccountId": "123456789012",
  "Status": "ENABLED",
  "ResourceTypes": [
    "EC2",
    "ECR",
    "LAMBDA"
  ],
  "Ec2Configuration": {
    "ScanMode": "EC2_SSM_AGENT_BASED"
  },
  "EcrConfiguration": {
    "RescanDuration": "LIFETIME"
  }
}

Best Practices

  1. Deployment Strategy
  2. Enable Inspector in all active regions
  3. Configure for all relevant resource types
  4. Implement centralized finding management
  5. Establish baseline security posture

  6. Regular configuration review and updates

  7. Finding Management

  8. Implement risk-based prioritization
  9. Configure automated suppression rules
  10. Establish SLA for finding remediation
  11. Integrate with ticketing systems

  12. Regular finding review and validation

  13. Integration Patterns

  14. Integrate with CI/CD pipelines for container scanning
  15. Configure automated notifications for critical findings
  16. Implement Security Hub for centralized management
  17. Use Systems Manager for automated patching

  18. Establish reporting and dashboard automation

  19. Compliance and Governance

  20. Map findings to compliance frameworks
  21. Implement finding tracking and metrics
  22. Regular security reporting and review
  23. Establish remediation procedures and ownership
  24. Continuous improvement of security practices

Integration with Other AWS Services

Core Integrations

  1. Security Hub: Centralized security findings management
  2. Systems Manager: Automated patching and remediation
  3. EventBridge: Event-driven automation and notifications
  4. CloudWatch: Monitoring and alerting for security metrics
  5. CloudFormation: Infrastructure as code deployment
  6. Lambda: Custom response and automation functions
  7. SNS: Finding notifications and alerting
  8. ECR: Container image vulnerability scanning
  9. CloudTrail: API activity auditing
  10. Config: Configuration compliance monitoring

Advanced Integrations

  1. CodePipeline: CI/CD security scanning integration
  2. CodeBuild: Build-time security assessment
  3. Organizations: Multi-account security management
  4. Trusted Advisor: Security recommendations
  5. GuardDuty: Threat detection correlation
  6. Macie: Data security and classification
  7. Third-party SIEM: External security tool integration
  8. Vulnerability Management: External scanning tools

Security Considerations

Vulnerability Assessment Coverage

  • Operating System: OS-level vulnerability detection
  • Application Software: Application vulnerability scanning
  • Container Images: Multi-layer container security assessment
  • Serverless Functions: Lambda function vulnerability analysis
  • Network Exposure: Reachability and exposure analysis

Data Protection and Privacy

  • Scan Data Security: Encrypted scanning and analysis
  • Finding Storage: Secure storage of vulnerability findings
  • Access Control: Restricted access to security information
  • Data Retention: Configurable finding retention policies
  • Compliance: Support for regulatory requirements

Risk Management

  • CVSS Scoring: Industry-standard vulnerability scoring
  • Exploit Prediction: Likelihood of exploitation analysis
  • Environmental Context: Network and system context consideration
  • Business Impact: Criticality and impact assessment

Monitoring and Troubleshooting

CloudWatch Metrics

  • FindingsGenerated: Number of new findings
  • CriticalFindings: High-severity finding count
  • CoveredResources: Number of resources being scanned
  • ScanDuration: Time taken for scanning operations

Common Issues and Solutions

  1. Missing Scan Coverage
  2. Verify SSM agent installation and connectivity
  3. Check IAM permissions for Inspector service
  4. Validate resource tags and filtering rules

  5. Review regional service availability

  6. High False Positive Rate

  7. Review and adjust suppression rules
  8. Validate vulnerability context and applicability
  9. Configure finding severity thresholds

  10. Implement whitelist for known acceptable findings

  11. Performance Impact

  12. Monitor resource utilization during scans
  13. Adjust scanning schedules for non-critical resources
  14. Optimize network bandwidth usage

  15. Review scan configuration and frequency

  16. Integration Issues

  17. Verify EventBridge rule configuration
  18. Check Security Hub integration settings
  19. Validate Lambda function permissions
  20. Test automated response workflows

Monitoring Tools

  1. Inspector Dashboard: Real-time vulnerability metrics
  2. Security Hub: Centralized security posture management
  3. CloudWatch Dashboards: Custom security monitoring
  4. Third-party Tools: External vulnerability management integration

Exam-Specific Tips and Common Scenarios

Solutions Architect Associate (SAA-C03)

  • Security Architecture: Implementing Inspector in security design
  • Vulnerability Management: Automated vulnerability assessment strategies
  • Integration Patterns: Combining with other security services
  • Cost Optimization: Balancing security coverage with costs

Solutions Architect Professional (SAP-C02)

  • Enterprise Security: Large-scale vulnerability management
  • Compliance Architecture: Meeting regulatory security requirements
  • Automation Strategy: Advanced security automation workflows
  • Multi-Account Management: Centralized vulnerability management

Security Specialty (SCS-C02)

  • Advanced Configuration: Custom vulnerability management workflows
  • Risk Assessment: Comprehensive security risk evaluation
  • Incident Response: Vulnerability-based incident investigation
  • Compliance Management: Regulatory compliance automation

Developer Associate (DVA-C02)

  • Application Security: Integrating security scanning in development
  • Container Security: Secure container development practices
  • CI/CD Integration: Security scanning in deployment pipelines
  • Serverless Security: Lambda function security best practices

Common Exam Scenarios

  1. Scenario: Need automated vulnerability scanning for EC2 instances Solution: Enable Inspector with SSM agent-based scanning

  2. Scenario: Secure container deployment pipeline Solution: Integrate Inspector ECR scanning with CI/CD pipeline

  3. Scenario: Compliance requirement for vulnerability assessment Solution: Configure Inspector with Security Hub for compliance reporting

  4. Scenario: Automated response to critical vulnerabilities Solution: Use Inspector with EventBridge and Lambda for automated remediation

Hands-on Examples and CLI Commands

Inspector Setup and Configuration

# Enable Inspector
aws inspector2 enable \
  --account-ids 123456789012 \
  --resource-types EC2 ECR LAMBDA

# Get Inspector configuration
aws inspector2 describe-organization-configuration

# Update Inspector configuration
aws inspector2 update-organization-configuration \
  --auto-enable ec2=true,ecr=true,lambda=true

# Disable Inspector
aws inspector2 disable \
  --account-ids 123456789012 \
  --resource-types EC2 ECR LAMBDA

# Get account permissions
aws inspector2 get-permissions

# List supported regions
aws inspector2 list-account-permissions

Finding Management

# List findings
aws inspector2 list-findings \
  --filter-criteria '{
    "severity": [{"comparison": "EQUALS", "value": "CRITICAL"}],
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_EC2_INSTANCE"}]
  }' \
  --max-results 100

# Get finding details
aws inspector2 get-findings \
  --finding-arns arn:aws:inspector2:us-east-1:123456789012:finding/12345678-1234-1234-1234-123456789012

# Create findings report
aws inspector2 create-findings-report \
  --report-format JSON \
  --s3-destination bucketName=security-reports,keyPrefix=inspector-findings/ \
  --filter-criteria '{
    "severity": [{"comparison": "EQUALS", "value": "HIGH"}]
  }'

# Get findings report status
aws inspector2 get-findings-report-status \
  --report-id 12345678-1234-1234-1234-123456789012

# List finding aggregations
aws inspector2 list-finding-aggregations \
  --aggregation-type TITLE \
  --aggregation-request '{
    "titleAggregation": {
      "resourceType": "AWS_EC2_INSTANCE",
      "sortBy": "CRITICAL",
      "sortOrder": "DESC"
    }
  }'

Coverage and Resource Management

# List coverage
aws inspector2 list-coverage \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_EC2_INSTANCE"}],
    "scanStatusCode": [{"comparison": "EQUALS", "value": "ACTIVE"}]
  }' \
  --max-results 100

# Get coverage statistics
aws inspector2 get-coverage-statistics \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_ECR_CONTAINER_IMAGE"}]
  }'

# List covered resources
aws inspector2 list-covered-resources \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_LAMBDA_FUNCTION"}]
  }'

# Search vulnerabilities
aws inspector2 search-vulnerabilities \
  --filter-criteria '{
    "vulnerabilityId": [{"comparison": "EQUALS", "value": "CVE-2021-44228"}]
  }'

ECR Container Scanning

# Scan ECR repository
aws inspector2 batch-get-account-status \
  --account-ids 123456789012

# List repository scan results
aws inspector2 list-findings \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_ECR_CONTAINER_IMAGE"}],
    "ecrImageRepositoryName": [{"comparison": "EQUALS", "value": "my-app"}]
  }'

# Get image scan details
aws inspector2 get-findings \
  --finding-arns arn:aws:inspector2:us-east-1:123456789012:finding/12345678-1234-1234-1234-123456789012

# Configure ECR scan settings
aws inspector2 update-configuration \
  --ecr-configuration rescanDuration=LIFETIME

Lambda Function Scanning

# List Lambda function findings
aws inspector2 list-findings \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_LAMBDA_FUNCTION"}],
    "severity": [{"comparison": "EQUALS", "value": "HIGH"}]
  }'

# Get Lambda function coverage
aws inspector2 list-coverage \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_LAMBDA_FUNCTION"}]
  }'

# Lambda vulnerability search
aws inspector2 search-vulnerabilities \
  --filter-criteria '{
    "vulnerabilitySource": [{"comparison": "EQUALS", "value": "NVD"}]
  }'

Suppression Rules

# Create suppression rule
aws inspector2 create-filter \
  --action SUPPRESS \
  --filter-criteria '{
    "vulnerabilityId": [{"comparison": "EQUALS", "value": "CVE-2021-12345"}],
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_EC2_INSTANCE"}]
  }' \
  --name "Suppress known false positive" \
  --description "Suppress CVE-2021-12345 for EC2 instances"

# List suppression rules
aws inspector2 list-filters

# Update suppression rule
aws inspector2 update-filter \
  --filter-arn arn:aws:inspector2:us-east-1:123456789012:filter/12345678-1234-1234-1234-123456789012 \
  --action SUPPRESS \
  --filter-criteria '{
    "vulnerabilityId": [{"comparison": "EQUALS", "value": "CVE-2021-12345"}]
  }'

# Delete suppression rule
aws inspector2 delete-filter \
  --filter-arn arn:aws:inspector2:us-east-1:123456789012:filter/12345678-1234-1234-1234-123456789012

Automated Response Integration

# Create EventBridge rule for Inspector findings
aws events put-rule \
  --name "InspectorCriticalFindingRule" \
  --event-pattern '{
    "source": ["aws.inspector2"],
    "detail-type": ["Inspector2 Finding"],
    "detail": {
      "severity": ["CRITICAL", "HIGH"]
    }
  }'

# Add Lambda target for automated response
aws events put-targets \
  --rule "InspectorCriticalFindingRule" \
  --targets '[
    {
      "Id": "1",
      "Arn": "arn:aws:lambda:us-east-1:123456789012:function:InspectorResponse"
    }
  ]'

# Create CloudWatch alarm for finding count
aws cloudwatch put-metric-alarm \
  --alarm-name "InspectorCriticalFindings" \
  --alarm-description "Alert on critical Inspector findings" \
  --metric-name "FindingCount" \
  --namespace "AWS/Inspector" \
  --statistic Sum \
  --period 3600 \
  --threshold 5 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1

Custom Response Lambda Function

import boto3
import json
import logging

logger = logging.getLogger()
logger.setLevel(logging.INFO)

def lambda_handler(event, context):
    """
    Automated response to Inspector findings
    """

    # Parse Inspector finding
    detail = event['detail']
    finding_arn = detail['findingArn']
    severity = detail['severity']
    resource_type = detail['resources'][0]['type']

    # Initialize AWS clients
    ssm = boto3.client('ssm')
    sns = boto3.client('sns')
    inspector = boto3.client('inspector2')

    logger.info(f"Processing finding: {finding_arn} with severity {severity}")

    # Automated response based on severity and resource type
    if severity in ['CRITICAL', 'HIGH']:
        if resource_type == 'AWS_EC2_INSTANCE':
            # Trigger automated patching
            trigger_automated_patching(detail, ssm)

        elif resource_type == 'AWS_ECR_CONTAINER_IMAGE':
            # Block vulnerable image deployment
            block_vulnerable_image(detail)

        elif resource_type == 'AWS_LAMBDA_FUNCTION':
            # Update Lambda function
            update_lambda_function(detail)

        # Send high priority notification
        send_security_alert(detail, sns)

    return {
        'statusCode': 200,
        'body': json.dumps('Inspector finding processed successfully')
    }

def trigger_automated_patching(detail, ssm):
    """Trigger automated patching for EC2 instances"""
    instance_id = detail['resources'][0]['id']

    # Run patch baseline
    response = ssm.send_command(
        InstanceIds=[instance_id],
        DocumentName='AWS-RunPatchBaseline',
        Parameters={
            'Operation': ['Install'],
            'RebootOption': ['RebootIfNeeded']
        }
    )

    logger.info(f"Triggered patching for instance {instance_id}: {response['Command']['CommandId']}")

def block_vulnerable_image(detail):
    """Block deployment of vulnerable container image"""
    logger.info("Implementing container image deployment block")
    # Implementation for blocking vulnerable image deployment

def update_lambda_function(detail):
    """Update Lambda function with security patches"""
    logger.info("Triggering Lambda function update")
    # Implementation for Lambda function security updates

def send_security_alert(detail, sns):
    """Send security alert notification"""
    message = f"""
    SECURITY ALERT: Inspector Finding

    Severity: {detail['severity']}
    Resource: {detail['resources'][0]['id']}
    Type: {detail['resources'][0]['type']}
    CVE: {detail.get('packageVulnerabilityDetails', {}).get('vulnerabilityId', 'N/A')}

    Finding ARN: {detail['findingArn']}

    Please investigate and remediate immediately.
    """

    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:123456789012:inspector-alerts',
        Subject='Critical Inspector Vulnerability Finding',
        Message=message
    )

Compliance Reporting

# Generate compliance report
aws inspector2 create-findings-report \
  --report-format CSV \
  --s3-destination bucketName=compliance-reports,keyPrefix=inspector/ \
  --filter-criteria '{
    "severity": [
      {"comparison": "EQUALS", "value": "CRITICAL"},
      {"comparison": "EQUALS", "value": "HIGH"}
    ],
    "findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}]
  }'

# Get vulnerability statistics for compliance
aws inspector2 get-findings-report-status \
  --report-id 12345678-1234-1234-1234-123456789012

# List findings by compliance framework
aws inspector2 list-findings \
  --filter-criteria '{
    "inspectorScore": [{"lowerInclusive": 7.0, "upperInclusive": 10.0}]
  }' \
  --sort-criteria '{
    "field": "INSPECTOR_SCORE",
    "sortOrder": "DESC"
  }'

This comprehensive Inspector documentation provides detailed coverage of vulnerability management capabilities essential for AWS certification preparation and real-world security operations.