Produces structured summaries of Amazon Inspector findings — severity distribution, finding type breakdown, and affected resources. Does NOT perform remediation prioritization or patching recommendations.

Works from both standalone accounts and delegated administrator accounts.

Classify the Request

User intent	Workflow
Summarize my Inspector findings	A: Account Findings Summary
What vulnerabilities does Inspector see	A: Account Findings Summary
Show vulnerability posture across org	B: Organization Findings Overview
Which accounts have most critical vulns	B: Organization Findings Overview

Workflow A: Account Findings Summary

Get aggregated counts by severity:

aws inspector2 list-finding-aggregations --aggregation-type ACCOUNT

Get aggregated counts by finding type:

aws inspector2 list-finding-aggregations --aggregation-type FINDING_TYPE

Get aggregated counts by resource type:

aws inspector2 list-finding-aggregations --aggregation-type AWS_EC2_INSTANCE
aws inspector2 list-finding-aggregations --aggregation-type AWS_LAMBDA_FUNCTION
aws inspector2 list-finding-aggregations --aggregation-type AWS_ECR_CONTAINER

For ECR context, aggregate by repository:

aws inspector2 list-finding-aggregations --aggregation-type REPOSITORY

For EC2 context, aggregate by AMI:

aws inspector2 list-finding-aggregations --aggregation-type AMI

Present summary:

Severity Count
Critical N
High N
Medium N
Low N

Finding Type Count Highest Severity
PACKAGE_VULNERABILITY N CRITICAL
CODE_VULNERABILITY N HIGH
NETWORK_REACHABILITY N MEDIUM

Resource Type Count Critical+High
AWS_EC2_INSTANCE N N
AWS_ECR_CONTAINER_IMAGE N N
AWS_LAMBDA_FUNCTION N N

SHOULD include top 5 AMIs/repositories/functions by finding count when relevant.

Severity	Count
Critical	N
High	N
Medium	N
Low	N

Finding Type	Count	Highest Severity
PACKAGE_VULNERABILITY	N	CRITICAL
CODE_VULNERABILITY	N	HIGH
NETWORK_REACHABILITY	N	MEDIUM

Resource Type	Count	Critical+High
AWS_EC2_INSTANCE	N	N
AWS_ECR_CONTAINER_IMAGE	N	N
AWS_LAMBDA_FUNCTION	N	N

Workflow B: Organization Findings Overview

Aggregate by account:

aws inspector2 list-finding-aggregations --aggregation-type ACCOUNT

Present per-account summary:

Account ID Critical High Medium Low Total
111111111111 N N N N N

MUST identify the top 5 accounts by critical+high findings count.

Account ID	Critical	High	Medium	Low	Total
111111111111	N	N	N	N	N

Get overall finding type distribution:

aws inspector2 list-finding-aggregations --aggregation-type FINDING_TYPE

Constraints

MUST use list-finding-aggregations for counts (not list-findings + manual counting)
MUST NOT perform remediation prioritization or patching recommendations
MUST NOT make suppression or exception recommendations
SHOULD present accounts sorted by critical+high count descending
MUST paginate aggregation results if response includes nextToken

Troubleshooting

Symptom	Resolution
list-finding-aggregations returns empty	No active findings — report zero findings
Only sees own account	Not a delegated admin — note: single-account view only
ACCOUNT aggregation shows one entry	Standalone account — use Workflow A

Output Sensitivity

Finding aggregations contain EC2 instance IDs, AMI IDs, ECR repository names, Lambda function ARNs, package names with CVE identifiers, and CVSS scores. Present the severity/type aggregation table first. Display full finding details only when the caller explicitly requests raw output.

references/inspector-findings.md

Raw file

aws/agent-toolkit-for-aws