Amazon Inspector
- What it is
- Automated, continuous vulnerability management. Scans workloads for software vulnerabilities and unintended network exposure.
- What it scans
- EC2 instances (via the Systems Manager agent), container images in Amazon Elastic Container Registry (ECR), and AWS Lambda functions and layers.
- Cross-references installed packages against the CVE database.
- How it works
- Continuous, event-driven rescanning — a new CVE published today re-evaluates existing resources automatically.
- Produces a risk score combining CVE severity with actual network reachability.
- Not to be confused with
- Amazon GuardDuty — detects active malicious behavior. Inspector finds potential weaknesses before they are exploited.
- AWS Config — evaluates resource configuration against your rules; Inspector looks inside the workload at software packages.