Skip to main content
In this lesson you’ll learn about AWS Inspector — a managed security assessment service that automatically scans workloads running on AWS to find software vulnerabilities and undesirable network exposure. Inspector helps you identify issues early by continuously evaluating resources throughout their lifecycle and re-assessing them when changes occur. What Inspector can discover and assess:
  • Amazon EC2 instances
  • Container images stored in Amazon Elastic Container Registry (ECR)
  • AWS Lambda functions
A diagram labeled "Inspector" showing a box titled "AWS Resources" containing icons for EC2, ECS, and Lambda. A red magnifying-glass Inspector icon is attached to the lower-left of the box.
If you install a new package on an EC2 instance, apply a patch, or a new CVE is published that affects a dependency, Inspector detects the change and automatically re-scans the affected resource. When an issue is found, Inspector creates a finding that includes:
  • Details about the vulnerability or misconfiguration
  • The affected resource
  • Recommended remediation steps and metadata to help prioritize response
Assessment targets control which resources Inspector scans. An assessment target is a resource group representing the set of resources you want Inspector to evaluate. Use tags or account grouping to limit scans to specific environments (for example, production but not development).
A slide titled "AWS Inspector Components" showing two boxed assessment targets: Assessment Target 1 (Environment = Develop) and Assessment Target 2 (Environment = Production). Each box contains orange AWS service icons (representing compute/instance resources) and small blue deployment package icons.
Key features of AWS Inspector
A presentation slide titled "Features" showing nine numbered tiles with colorful circular icons and short labels. The tiles list capabilities like "Centrally Manage Your Environment," "Continuous Scanning," "Dashboard," and "Customizable Views."
Inspector produces three primary types of findings:
A presentation slide titled "Notes" showing three colorful circular icons labeled "Package Vulnerability" (orange box), "Code Vulnerability" (pink code symbol), and "Network reachability" (green network node).
Typical Inspector workflow
  1. Define assessment targets — group the resources you want to scan (for example, by tags or accounts).
  2. Select rules packages — choose built-in rule packages (vulnerability checks, network reachability, CIS benchmarks, etc.) that align with your goals.
  3. Run assessments — execute assessment runs against the chosen targets and rule packages.
  4. Review findings — analyze results in the Inspector console; use severity scores, affected resources, and metadata to prioritize work.
  5. Remediate and re-assess — apply patches, configuration changes, or code fixes and let Inspector re-scan to confirm remediation.
Findings can be integrated into broader security workflows. Common integrations include forwarding findings to AWS Security Hub, routing events via Amazon EventBridge, or triggering automated remediation pipelines so you can automate triage and response.
Inspector continuously re-evaluates resources and re-scans them when package installs, patches, new CVEs, or configuration changes occur — helping detect regressions and new exposures as your environment evolves.
Links and references

Watch Video