Amazon Inspector: AWS Vulnerability Scanning Guide (2026)

To use Amazon Inspector, activate the required scan types in each AWS Region, verify resource coverage, and review findings rather than assuming activation means every workload is scanned. For multi-account environments, use AWS Organizations policies or a delegated administrator and enable new member accounts automatically.

What does Amazon Inspector scan?

Amazon Inspector is AWS’s vulnerability management service. It discovers supported workloads and creates findings for software vulnerabilities and unintended network exposure.

Scan type	What Inspector evaluates	Important boundary
EC2 scanning	Operating-system and supported programming-language packages, CVEs, and network reachability	Coverage depends on supported operating systems and the available agent-based or agentless method
ECR enhanced scanning	Active private ECR container images for operating-system and programming-language package vulnerabilities	Re-scan duration and image activity rules determine how long images remain monitored
Lambda standard scanning	Lambda functions and layers for supported package vulnerabilities	Functions are rescanned on deployment, update, or relevant new CVEs
Lambda code scanning	Application code for issues such as injection, data leaks, missing encryption, and weak cryptography	Optional; finding snippets can contain sensitive code or credentials

Amazon Inspector also offers Code Security for first-party code, dependencies, and infrastructure as code. Treat that as a separate code-security surface rather than assuming the standard EC2, ECR, and Lambda activation covers every repository.

Enable Amazon Inspector in one AWS account

Sign in to the AWS console and open Amazon Inspector.
Select the AWS Region you want to cover.
Choose Get started or Activate Inspector.
In Account management, confirm the scan types you require: EC2, ECR, Lambda standard, and optionally Lambda code scanning.
Open Coverage and check the status and last-scanned time for each expected resource.
Repeat the activation and coverage check in every AWS Region where the account runs supported resources.

Amazon Inspector is regional. Enabling it in one Region does not provide organization-wide or global coverage.

Enable Amazon Inspector with AWS CLI

Enable the standard EC2, ECR, and Lambda scan types:

aws inspector2 enable \
  --resource-types EC2 ECR LAMBDA \
  --region eu-central-1

Check the account status:

aws inspector2 batch-get-account-status \
  --region eu-central-1

List covered resources and their status:

aws inspector2 list-coverage \
  --region eu-central-1

List active findings:

aws inspector2 list-findings \
  --filter-criteria '{"findingStatus":[{"comparison":"EQUALS","value":"ACTIVE"}]}' \
  --region eu-central-1

Specify the Region deliberately in automation. A successful command against the wrong default Region does not establish coverage where your workloads run.

EC2 vulnerability scanning: agent-based or agentless?

Amazon Inspector supports two ways to collect EC2 software inventory.

Agent-based scanning

Agent-based scanning uses AWS Systems Manager. The instance must be supported and managed by SSM, with the required connectivity, permissions, and associations. This method can react to inventory changes and new CVEs and supports deep-inspection paths on eligible Linux instances.

If an expected instance is not covered, check:

Whether its operating system and version are supported
SSM managed-instance status and SSM Agent health
The instance profile and Systems Manager permissions
Network access to the required Systems Manager endpoints
Inspector exclusion tags
The Coverage reason reported for the instance

Agentless scanning

Agentless scanning collects inventory from temporary EBS snapshots. In hybrid mode, Inspector can use it for eligible instances that are not successfully covered through SSM.

Agentless coverage has constraints. The instance must use a supported operating system and EBS-backed supported file systems, and AWS documents limits on attached volume count and total size. Encrypted-volume access and exclusion tags also affect eligibility. Inspector creates temporary tagged snapshots, evaluates them with EBS direct APIs, and then deletes them.

Hybrid mode

Hybrid mode combines both methods: SSM-managed eligible instances use agent-based scanning, and eligible unmanaged or stale-inventory instances can fall back to agentless scanning. Review the current account setting under EC2 scanning settings because defaults and upgrade paths can differ between accounts activated at different times.

Enable Amazon Inspector across AWS Organizations

For multiple AWS accounts, centralize administration instead of activating member accounts by hand.

From the AWS Organizations management account, designate a security account as the Amazon Inspector delegated administrator.
In the delegated administrator account, open Amazon Inspector in each required Region.
Prefer AWS Organizations policies when you need centrally enforced, automatic scan-type enablement.
Otherwise, use Account management to activate the required scan types for existing member accounts.
Turn on automatic activation for new member accounts.
Set the EC2 scan mode, deep-inspection paths, ECR re-scan duration, and suppression rules deliberately.
Review organization-wide Coverage and investigate accounts or resources with non-covered status.

The delegated administrator relationship and Inspector activation are regional. AWS Organizations policies can govern which scan types are enabled; when they do, member accounts and the delegated administrator cannot disable those policy-managed scan types through ordinary Inspector enablement APIs.

Monitor Amazon Inspector coverage

An empty findings list does not prove that an environment is vulnerability-free. It can also mean that a resource was not covered.

Track at least:

Accounts and Regions where Inspector is active
Expected versus covered EC2 instances, ECR images, and Lambda functions
Coverage status and reason
Last scanned time
Scan mode used for each EC2 instance
Images that aged out of ECR monitoring
Suppressed findings and suppression-rule ownership
Failed organization auto-enablement

Make coverage a measurable control with an owner and alert threshold. Review it whenever accounts, Regions, operating systems, or deployment patterns change.

How Amazon Inspector pricing behaves at scale

Pricing varies by scan type and Region. Inspector’s Usage page shows actual usage and projected 30-day cost, including per-account details for delegated administrators.

The cost drivers differ by resource type: EC2 uses average covered instances, ECR uses image scans and re-scans, Lambda uses functions and scan coverage, and optional code-scanning features have their own units. Before organization-wide activation:

Inventory expected resources by account and Region.
Estimate each enabled scan type separately using current AWS pricing.
Roll out to a representative organizational unit.
Compare the projection in Usage with your estimate.
Set budgets and cost-allocation ownership before expanding coverage.

Do not reduce cost by silently excluding assets. If a resource is intentionally excluded, record the compensating control and owner.

What Amazon Inspector does not replace

Inspector is primarily a workload-vulnerability and network-exposure service. It does not replace a broader cloud security posture program that checks control-plane configuration across IAM, S3, CloudTrail, databases, Kubernetes, and other services.

That distinction matters when evaluating tools: vulnerability management asks whether deployed software has exploitable weaknesses; CSPM asks whether cloud resources and permissions are configured safely. Mature AWS environments need both surfaces, with coverage evidence for each.

Kloudle’s self-hosted posture layer evaluates cloud configuration in your infrastructure and keeps findings in your database. It complements Inspector; it is not presented as an Inspector replacement or package-CVE scanner.

Official AWS references

Updated August 2026.