Amazon Inspector: Prioritizing Findings Across EC2, ECR, and Lambda
A detector and a prioritizer — continuously finding, correlating, and ranking vulnerabilities across your compute, containers, and functions. Not a patcher. Not a firewall. Not proof of security.
Amazon Inspector is an automated vulnerability-management service on AWS. Once enabled, it continuously evaluates supported resources — EC2 instances, ECR container images, and Lambda functions — and correlates the software packages and code it discovers with a vulnerability-intelligence feed. The output is a ranked list of findings enriched with severity, exploitability, and exposure context, so your team spends its effort where it actually matters.
Continuous Evaluation
Not a one-shot scan. After enablement, Inspector keeps scanning EC2 (agent or agentless), ECR images, and Lambda functions as they change.
Correlation Engine
Matches the packages and code it discovers against vulnerability intelligence (CVE feed) — a package you don't know you have still gets matched.
Prioritized Findings
Each finding is enriched with severity, exploitability, and exposure context, sorted so the most dangerous, most reachable ones surface first.
Coverage Boundary
The dashboard is only as true as its coverage: resources, regions, scan types, and agent/agentless paths that are actually in the population.
- Enable the service in the account and region — from that point it runs continuously.
- Scan supported resources: EC2 instances, ECR images in the registry, and Lambda function code.
- Correlate discovered packages and code against the vulnerability-intelligence feed.
- Rank findings by severity, exploitability, and exposure — that ordering is the product.
- Verify closure: remediate a finding and confirm it disappears from the dashboard.
- Container shift-left: ECR images are scanned in the registry, so vulnerable images can be blocked before promotion to production.
- Serverless inventory: Lambda functions are assessed agentlessly — no daemon to install in the function.
- Remediation triage: rank by exploitability × exposure, not raw severity, so the fix queue matches real risk.
- Continuous posture evidence: an always-on scan gives a running audit trail instead of point-in-time scan reports.
- What exactly does a clean Inspector dashboard prove — and what does it not prove? Think in terms of what is inside the coverage population.
- Inspector is explicitly not a patcher, firewall, or security proof. What is it, and what are the three enrichment fields on its findings? detector + prioritizer; severity, exploitability, exposure.
- You want to falsify the pipeline in a test environment. Describe the experiment: what do you plant, and what two things do you measure before and after remediation? a known vulnerable package in a test image; detection latency, then finding closure.