Amazon Inspector mindmap

Amazon Inspector

Automated vulnerability management that continually scans AWS workloads for software vulnerabilities and unintended network exposure

• EC2 scanning: Package vulnerabilities and network reachability for EC2 instances
  • Agent-based scanning: Uses the SSM Agent on managed instances
  • Agentless scanning: Scans EBS snapshots for instances without the SSM Agent
  • When scans run: When an instance is discovered, when software changes, and when a new CVE is added to the database
  • CIS benchmarks: Operating system configuration checks against CIS benchmarks
• Container image scanning: Images in Amazon ECR
  • On push or continuous: Scan once when pushed, or keep rescanning as new CVEs appear
  • Operating system and programming language packages: What enhanced scanning looks at
  • Mapping to running containers: Shows where an image runs on ECS and EKS
• Lambda scanning: Scans function code and dependencies
  • Standard scanning: Vulnerable packages in function code and layers
  • Code scanning: Vulnerabilities in the code you wrote, such as injection flaws and weak cryptography
• Code security: Scans source code repositories
  • Static application security testing (SAST): Flaws in first-party code
  • Software composition analysis (SCA): Vulnerable third-party dependencies
  • Infrastructure as code: Misconfigurations in IaC templates
• Findings: What Inspector reports and how it is rated
  • Package vulnerability: A known CVE in an installed package
  • Network reachability: Open network paths to an EC2 instance
  • Code vulnerability: Issues found in Lambda code or repositories
  • Inspector score: The CVSS base score adjusted for your environment, such as network reachability
  • Severity: Informational, Low, Medium, High and Critical
  • Suppression rules: Hide findings that match criteria you set
• Export and integration: Move findings and inventory to other tools
  • SBOM export: Software bill of materials in CycloneDX or SPDX format to Amazon S3
  • AWS Security Hub: Findings appear with your other security findings
  • Amazon EventBridge: Automate ticketing and remediation
  • Findings reports: Export findings as CSV or JSON to Amazon S3
• Multi-account management: A delegated administrator activates scanning for every member account
  • 15-day free trial: For accounts new to Amazon Inspector