Inspector

Amazon Inspector is a vulnerability management service that automatically scans EC2 instances, ECR container images, Lambda functions, and ECS containers for software vulnerabilities, code weaknesses, and network exposure. It uses CVSS scoring and incorporates exploitability context. Findings are in Inspector’s proprietary JSON format and are also sent to Security Hub in OCSF format.

Data Sources

Inspector automatically discovers and scans:

• EC2 instances (via SSM agent) — OS package vulnerabilities, network reachability
• ECR container images — image layer vulnerabilities
• Lambda functions — code vulnerabilities, package vulnerabilities
• ECS containers — running container image vulnerabilities

Read-Only APIs

Severity Scoring

Inspector uses CVSS (Common Vulnerability Scoring System) for package vulnerabilities and a severity mapping for other finding types:

Package Vulnerabilities (CVSS-based)

Other Finding Types

Key notes:

• Inspector uses the highest available CVSS score (NVD or vendor-provided)
• Inspector Score may differ from raw CVSS — it incorporates exploitability and fix availability
• ECR findings include both CVSS v2 and v3 scores when available

Documentation: https://docs.aws.amazon.com/inspector/latest/user/findings-understanding-severity.html (opens in a new tab)

Service Notes

No service-specific notes.

Output Sensitivity

Inspector finding details (ListFindings, BatchGetFindingDetails, coverage APIs) contain:

• EC2 instance IDs and AMI IDs
• ECR repository names and image digests
• Lambda function names and ARNs
• Package names and installed versions with CVE identifiers
• Network configuration details (ports, protocols, paths)
• Code file paths and line numbers (code vulnerabilities)

Present severity/type aggregation first. Offer full finding details on request.