> ## Documentation Index
> Fetch the complete documentation index at: https://resources.devweekends.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Inspector

> Automated security assessment service for vulnerabilities and security best practices

## Overview

AWS Inspector is an **automated security assessment service** that helps you improve the security and compliance of applications deployed on AWS. It automatically assesses applications for vulnerabilities, exposure, and deviations from best practices. Think of Inspector as a continuous vulnerability scanner that knows your infrastructure context. Unlike generic CVE scanners, Inspector combines vulnerability data with network reachability analysis -- a critical CVE on an instance that has no internet-facing ports is lower priority than the same CVE on a publicly accessible web server. This context-aware scoring is what makes Inspector more actionable than raw CVE feeds.

## Core Concepts

### Scan Types

**EC2 Instance Scanning**

```yaml theme={null}
What Gets Scanned:
  - Operating system packages (RPM, DEB)
  - Application dependencies
  - Network reachability
  - File paths
  
CVE Detection:
  - Package vulnerabilities
  - Known software vulnerabilities
  - Common Vulnerabilities and Exposures
  
Requirements:
  - SSM Agent installed
  - Instance has SSM permissions
  - Network access configured
```

**ECR Container Image Scanning**

```yaml theme={null}
Scanning Types:
  Basic Scanning:
    - On-push scanning
    - Uses Clair engine
    - Scans OS packages
    
  Enhanced Scanning (Inspector):
    - Continuous monitoring
    - OS and programming language packages
    - SBOM (Software Bill of Materials)
    - Auto-scan on push
    
Supported Languages:
  - Go, Java, JavaScript/Node.js
  - Python, Ruby, .NET, PHP
  
SBOM Generation:
  - JSON format
  - Lists all components
  - Export to S3
```

**Lambda Function Scanning**

```yaml theme={null}
What Gets Scanned:
  - Application code
  - Package dependencies
  - Layers
  - Runtime vulnerabilities
  
Supported Runtimes:
  - Python, Node.js, Java
  - .NET, Go, Ruby
  
Automatic Scanning:
  - On function update
  - On layer update
  - Continuous monitoring
  
No Additional Setup:
  - Automatic for all functions
  - No agent required
  - No configuration needed
```

### Vulnerability Scoring

## Enabling Inspector

### For EC2 Instances

```bash theme={null}
# Enable Inspector for EC2 in account
aws inspector2 enable \
  --resource-types EC2 \
  --account-ids 123456789012

# Check status
aws inspector2 batch-get-account-status \
  --account-ids 123456789012

# Get findings for EC2
aws inspector2 list-findings \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_EC2_INSTANCE"}],
    "severity": [{"comparison": "EQUALS", "value": "CRITICAL"}]
  }'
```

### For ECR

```bash theme={null}
# Enable Inspector scanning for ECR
aws inspector2 enable \
  --resource-types ECR

# Enable enhanced scanning for specific repo
aws ecr put-image-scanning-configuration \
  --repository-name my-app \
  --image-scanning-configuration scanOnPush=true

# Get ECR findings
aws inspector2 list-findings \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_ECR_CONTAINER_IMAGE"}],
    "severity": [{"comparison": "EQUALS", "value": "HIGH"}]
  }'

# Get SBOM
aws inspector2 list-coverage \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_ECR_CONTAINER_IMAGE"}]
  }'
```

### For Lambda

```bash theme={null}
# Enable Inspector for Lambda
aws inspector2 enable \
  --resource-types LAMBDA \
  --account-ids 123456789012

# Lambda scanning is automatic - no additional config needed

# Get Lambda findings
aws inspector2 list-findings \
  --filter-criteria '{
    "resourceType": [{"comparison": "EQUALS", "value": "AWS_LAMBDA_FUNCTION"}],
    "severity": [{"comparison": "EQUALS", "value": "CRITICAL"}]
  }'
```

## Terraform Configuration

```hcl theme={null}
# Enable Inspector
resource "aws_inspector2_enabler" "main" {
  account_ids    = [data.aws_caller_identity.current.account_id]
  resource_types = ["EC2", "ECR", "LAMBDA"]
}

# ECR repository with enhanced scanning
resource "aws_ecr_repository" "app" {
  name                 = "my-application"
  image_tag_mutability = "MUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }

  encryption_configuration {
    encryption_type = "KMS"
    kms_key         = aws_kms_key.ecr.arn
  }

  tags = {
    Environment = "production"
  }
}

# Inspector delegated admin (for Organizations)
resource "aws_inspector2_delegated_admin_account" "main" {
  account_id = "123456789012"
}

# Inspector member association
resource "aws_inspector2_member_association" "members" {
  account_id = "111122223333"
}

# EventBridge rule for critical findings
resource "aws_cloudwatch_event_rule" "inspector_critical" {
  name        = "inspector-critical-findings"
  description = "Capture critical Inspector findings"

  event_pattern = jsonencode({
    source      = ["aws.inspector2"]
    detail-type = ["Inspector2 Finding"]
    detail = {
      severity = ["CRITICAL"]
      status   = ["ACTIVE"]
    }
  })
}

resource "aws_cloudwatch_event_target" "notify" {
  rule      = aws_cloudwatch_event_rule.inspector_critical.name
  target_id = "SendToSNS"
  arn       = aws_sns_topic.security_alerts.arn
}

# SNS topic for alerts
resource "aws_sns_topic" "security_alerts" {
  name = "inspector-security-alerts"
}

resource "aws_sns_topic_subscription" "email" {
  topic_arn = aws_sns_topic.security_alerts.arn
  protocol  = "email"
  endpoint  = "security-team@example.com"
}
```

## Finding Management

### Understanding Findings

```json theme={null}
{
  "findingArn": "arn:aws:inspector2:us-east-1:123456789012:finding/...",
  "awsAccountId": "123456789012",
  "type": "PACKAGE_VULNERABILITY",
  "description": "CVE-2024-12345 - Remote Code Execution in libssl1.1",
  "severity": "CRITICAL",
  "firstObservedAt": "2024-01-15T10:00:00.000Z",
  "lastObservedAt": "2024-01-15T10:00:00.000Z",
  "updatedAt": "2024-01-15T10:00:00.000Z",
  "status": "ACTIVE",
  "remediation": {
    "recommendation": {
      "text": "Update libssl1.1 to version 1.1.1w-0+deb11u1 or later",
      "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12345"
    }
  },
  "packageVulnerabilityDetails": {
    "vulnerabilityId": "CVE-2024-12345",
    "vulnerablePackages": [
      {
        "name": "libssl1.1",
        "version": "1.1.1n-0+deb11u3",
        "architecture": "amd64",
        "packageManager": "APT"
      }
    ],
    "source": "NVD",
    "cvss": {
      "version": "3.1",
      "baseScore": 9.8,
      "scoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "referenceUrls": [
      "https://nvd.nist.gov/vuln/detail/CVE-2024-12345"
    ]
  },
  "resources": [
    {
      "type": "AWS_EC2_INSTANCE",
      "id": "i-1234567890abcdef0",
      "details": {
        "awsEc2Instance": {
          "type": "t3.medium",
          "platform": "UBUNTU_20_04",
          "ipV4Addresses": ["10.0.1.50"]
        }
      }
    }
  ],
  "networkReachabilityDetails": {
    "networkPath": {
      "steps": [
        {
          "componentType": "INTERNET_GATEWAY"
        },
        {
          "componentType": "SECURITY_GROUP",
          "componentId": "sg-0123456789abcdef0"
        }
      ]
    },
    "openPortRange": {
      "begin": 443,
      "end": 443
    },
    "protocol": "TCP"
  },
  "exploitAvailable": "YES",
  "fixAvailable": "YES"
}
```

### Automated Remediation

```python theme={null}
import boto3
import json

inspector = boto3.client('inspector2')
ssm = boto3.client('ssm')
sns = boto3.client('sns')

def lambda_handler(event, context):
    """
    Automated response to Inspector findings
    """
    finding = event['detail']
    severity = finding['severity']
    resource_type = finding['resources'][0]['type']
    
    if severity == 'CRITICAL' and finding['fixAvailable'] == 'YES':
        if resource_type == 'AWS_EC2_INSTANCE':
            remediate_ec2_vulnerability(finding)
        elif resource_type == 'AWS_ECR_CONTAINER_IMAGE':
            notify_container_vulnerability(finding)
        elif resource_type == 'AWS_LAMBDA_FUNCTION':
            remediate_lambda_vulnerability(finding)

def remediate_ec2_vulnerability(finding):
    """
    Patch EC2 instance using Systems Manager.
    
    This is the "golden path" for EC2 patching: Inspector detects the vuln,
    EventBridge triggers this Lambda, and SSM Run Command applies the patch.
    No SSH access needed, no bastion hosts, fully auditable.
    
    Common mistake: patching without testing. In production, route the
    SSM command to a staging instance first, verify the patch doesn't break
    your application, THEN apply to production instances in a rolling fashion.
    """
    instance_id = finding['resources'][0]['id']
    vulnerability_id = finding['packageVulnerabilityDetails']['vulnerabilityId']
    
    # Get affected package
    vulnerable_pkg = finding['packageVulnerabilityDetails']['vulnerablePackages'][0]
    package_name = vulnerable_pkg['name']
    fixed_version = finding['remediation']['recommendation']['text']
    
    # Run patch command via SSM
    response = ssm.send_command(
        InstanceIds=[instance_id],
        DocumentName='AWS-RunPatchBaseline',
        Parameters={
            'Operation': ['Install']
        },
        Comment=f'Patching {vulnerability_id} - {package_name}'
    )
    
    command_id = response['Command']['CommandId']
    
    # Notify team
    notify_remediation(
        finding,
        f'Initiated patching on {instance_id}. SSM Command: {command_id}'
    )

def notify_container_vulnerability(finding):
    """
    Alert team about container vulnerability
    """
    image_uri = finding['resources'][0]['id']
    vulnerability_id = finding['packageVulnerabilityDetails']['vulnerabilityId']
    cvss_score = finding['packageVulnerabilityDetails']['cvss']['baseScore']
    
    message = {
        'severity': finding['severity'],
        'vulnerability': vulnerability_id,
        'cvss_score': cvss_score,
        'image': image_uri,
        'action_required': 'Rebuild container image with updated base image',
        'remediation': finding['remediation']['recommendation']['text']
    }
    
    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:123456789012:container-security',
        Subject=f'CRITICAL: Container Vulnerability {vulnerability_id}',
        Message=json.dumps(message, indent=2)
    )

def remediate_lambda_vulnerability(finding):
    """
    Update Lambda function dependencies
    """
    function_arn = finding['resources'][0]['id']
    function_name = function_arn.split(':')[-1]
    
    vulnerability_id = finding['packageVulnerabilityDetails']['vulnerabilityId']
    
    # Get Lambda function
    lambda_client = boto3.client('lambda')
    function = lambda_client.get_function(FunctionName=function_name)
    
    message = {
        'severity': finding['severity'],
        'function': function_name,
        'vulnerability': vulnerability_id,
        'runtime': function['Configuration']['Runtime'],
        'action_required': 'Update function dependencies and redeploy',
        'remediation': finding['remediation']['recommendation']['text']
    }
    
    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:123456789012:lambda-security',
        Subject=f'Lambda Vulnerability: {function_name}',
        Message=json.dumps(message, indent=2)
    )

def notify_remediation(finding, action_taken):
    """
    Send notification about remediation action
    """
    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:123456789012:security-remediation',
        Subject=f"Inspector Remediation: {finding['packageVulnerabilityDetails']['vulnerabilityId']}",
        Message=json.dumps({
            'finding_arn': finding['findingArn'],
            'severity': finding['severity'],
            'vulnerability': finding['packageVulnerabilityDetails']['vulnerabilityId'],
            'action_taken': action_taken
        }, indent=2)
    )
```

## Suppression Rules

```python theme={null}
import boto3

inspector = boto3.client('inspector2')

def create_suppression_rule():
    """
    Suppress findings for dev environment
    """
    response = inspector.create_filter(
        action='SUPPRESS',
        description='Suppress low severity findings in development',
        filterCriteria={
            'severity': [
                {
                    'comparison': 'EQUALS',
                    'value': 'LOW'
                }
            ],
            'resourceTags': [
                {
                    'comparison': 'EQUALS',
                    'key': 'Environment',
                    'value': 'development'
                }
            ]
        },
        name='suppress-dev-low-severity',
        reason='Low severity acceptable in dev environment'
    )
    return response

def suppress_specific_cve():
    """
    Suppress specific CVE across all resources
    """
    response = inspector.create_filter(
        action='SUPPRESS',
        description='Suppress CVE-2024-12345 - false positive',
        filterCriteria={
            'vulnerabilityId': [
                {
                    'comparison': 'EQUALS',
                    'value': 'CVE-2024-12345'
                }
            ]
        },
        name='suppress-cve-2024-12345',
        reason='False positive - not applicable to our use case'
    )
    return response
```

## Multi-Account Setup

### Organization Integration

### Designate Delegated Administrator

```bash theme={null}
# From management account
aws inspector2 enable-delegated-admin-account \
  --delegated-admin-account-id 123456789012
```

### Enable Auto-Enable

```bash theme={null}
# From delegated admin account
aws inspector2 update-organization-configuration \
  --auto-enable '{
    "ec2": true,
    "ecr": true,
    "lambda": true
  }'
```

### Add Member Accounts

```bash theme={null}
# Associate member accounts
aws inspector2 associate-member \
  --account-id 111122223333

aws inspector2 associate-member \
  --account-id 444455556666
```

## Best Practices

> **Enable All Resource Types**
>
> Enable scanning for EC2, ECR, and Lambda for complete coverage

> **Automate Patching**
>
> Use Systems Manager for automated EC2 patching

> **SBOM Generation**
>
> Generate and store SBOM for compliance and audit

> **Integrate with CI/CD**
>
> Fail builds on critical vulnerabilities in containers

### Security Checklist

```yaml theme={null}
Inspector Best Practices:
  Setup:
    ☐ Enable Inspector in all regions
    ☐ Configure delegated administrator
    ☐ Enable auto-enable for new accounts
    ☐ Set up EventBridge rules
    
  Monitoring:
    ☐ Daily review of critical findings
    ☐ Weekly review of high severity
    ☐ Track patching metrics
    ☐ Monitor SBOM generation
    
  Remediation:
    ☐ Automate EC2 patching where possible
    ☐ Set up container rebuild pipelines
    ☐ Update Lambda dependencies regularly
    ☐ Document suppression reasons
    
  Compliance:
    ☐ Generate regular vulnerability reports
    ☐ Export SBOM for compliance
    ☐ Track time-to-remediation
```

## Cost Optimization

```yaml theme={null}
Pricing Model:
  EC2 Scanning:
    - $0.30 per instance per month
    - Charged per active instance
    # Cost tip: 100 EC2 instances = $30/month -- very reasonable
    # compared to commercial vulnerability scanners at $5-15/instance
    
  ECR Scanning:
    - First scan per image: FREE
    - Re-scan if pushed: FREE
    - Continuous monitoring: $0.09 per image per month
    # Cost tip: only enable continuous monitoring for production images.
    # Dev/test images get scanned on push, which is usually sufficient.
    
  Lambda Scanning:
    - $0.60 per function per month
    - Includes code and layers
    # Cost tip: if you have 200 Lambda functions but only 30 are
    # production-critical, use tags and Inspector filters to focus scanning.
    
Optimization Tips:
  - Use tags to exclude dev resources from continuous scanning
  - Create suppression rules for accepted risks (with documented justification)
  - Disable scanning for deprecated resources pending decommission
  - Export findings to S3 for long-term storage and trend analysis
  - Track mean-time-to-remediation (MTTR) as a KPI -- aim for <7 days for critical
```

## Exam Tips

> **Key Concepts for AWS Exams**
>
> * Inspector scans **EC2, ECR, Lambda** for vulnerabilities
> * Uses **CVE database** and **SBOM** analysis
> * Provides **CVSS scores** and **network reachability** context
> * **Automatic** for Lambda and ECR (when enabled)
> * Requires **SSM Agent** for EC2 scanning
> * Integrates with **Security Hub** for centralized findings
> * **EventBridge** for automated response
> * **Suppression rules** for false positives

> **Common Exam Scenarios**
>
> **Q: How to scan EC2 instances for vulnerabilities?**
> A: Enable Inspector and ensure SSM Agent is installed on instances
>
> **Q: How to automatically patch EC2 vulnerabilities?**
> A: EventBridge → Lambda → Systems Manager Run Command
>
> **Q: How to scan container images?**
> A: Enable Inspector ECR scanning with scan-on-push
>
> **Q: How to centralize vulnerability findings?**
> A: Use delegated administrator with Security Hub integration


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.