Amazon Inspector
Amazon Inspector is an automated vulnerability management service of Amazon Web Services that continually scans AWS workloads for software vulnerabilities and unintended network exposure.
AI Practitioner focus
- Inspector scans supported EC2, ECR, Lambda, and code resources for software vulnerabilities and network exposure around an AI application.
- It does not inspect prompts, detect hallucinations, measure model bias, or classify training data; use domain-specific controls for those risks.
Key points
- Automated vulnerability management service that continually scans Amazon EC2 instances, Amazon Elastic Container Registry (ECR) container images, and AWS Lambda functions (standard scanning, activated by default) for software vulnerabilities and unintended network exposure — rescanning automatically whenever a new vulnerability is published or the resource changes, not just at initial deployment.
- Identifies unintended network access in addition to detecting software vulnerabilities on instances.
- Optional Lambda code scanning evaluates a function’s application package dependencies for CVEs, layered on top of Lambda standard scanning. Separately, Code Security for Amazon Inspector uses the Amazon Q Developer scanning engine to scan first-party application code, third-party dependencies, and infrastructure-as-code for vulnerabilities.
- Findings are scored using the CVSS standard and adjusted for the specific compute environment into the Amazon Inspector risk score to help prioritize remediation.
- Produces automated security reports rather than requiring manual review.
- Inspector finds vulnerabilities in the resources it scans; it does not perform account-wide threat detection or aggregate findings across services (Amazon GuardDuty, AWS Security Hub — now AWS Security Hub CSPM), and it does not discover or classify sensitive data (Amazon Macie).