Amazon Inspector
Automated vulnerability scanning
Automatically and continuously scans for software vulnerabilities (CVEs) and network exposure on EC2, ECR images, and Lambda functions, with context-aware risk scoring.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
- In examsCLF · SAA · SOA
Think of it asLike an inspector making regular rounds to check every lock for ones that are outdated.
When to use it
✓ Use it when
You need to know which instances, container images, or Lambda functions have vulnerabilities to patch.
✗ Avoid it when
Detecting attacks in progress → GuardDuty; finding sensitive data → Macie.
Common uses
- Scan ECR images before deployment
- List EC2 instances missing patches
- Detect network ports open to the Internet
What does it cost?
- Pricing model: Charged by the number of EC2 instances, container images, and Lambda functions scanned each month.
Related services
SAA-C03 study guide
Inspector is covered in these study modules: