> ## Documentation Index
> Fetch the complete documentation index at: https://resources.devweekends.com/llms.txt
> Use this file to discover all available pages before exploring further.
# AWS Inspector
> Automated security assessment service for vulnerabilities and security best practices
## Overview
AWS Inspector is an **automated security assessment service** that helps you improve the security and compliance of applications deployed on AWS. It automatically assesses applications for vulnerabilities, exposure, and deviations from best practices. Think of Inspector as a continuous vulnerability scanner that knows your infrastructure context. Unlike generic CVE scanners, Inspector combines vulnerability data with network reachability analysis -- a critical CVE on an instance that has no internet-facing ports is lower priority than the same CVE on a publicly accessible web server. This context-aware scoring is what makes Inspector more actionable than raw CVE feeds.
## Core Concepts
### Scan Types
**EC2 Instance Scanning**
```yaml theme={null}
What Gets Scanned:
- Operating system packages (RPM, DEB)
- Application dependencies
- Network reachability
- File paths
CVE Detection:
- Package vulnerabilities
- Known software vulnerabilities
- Common Vulnerabilities and Exposures
Requirements:
- SSM Agent installed
- Instance has SSM permissions
- Network access configured
```
**ECR Container Image Scanning**
```yaml theme={null}
Scanning Types:
Basic Scanning:
- On-push scanning
- Uses Clair engine
- Scans OS packages
Enhanced Scanning (Inspector):
- Continuous monitoring
- OS and programming language packages
- SBOM (Software Bill of Materials)
- Auto-scan on push
Supported Languages:
- Go, Java, JavaScript/Node.js
- Python, Ruby, .NET, PHP
SBOM Generation:
- JSON format
- Lists all components
- Export to S3
```
**Lambda Function Scanning**
```yaml theme={null}
What Gets Scanned:
- Application code
- Package dependencies
- Layers
- Runtime vulnerabilities
Supported Runtimes:
- Python, Node.js, Java
- .NET, Go, Ruby
Automatic Scanning:
- On function update
- On layer update
- Continuous monitoring
No Additional Setup:
- Automatic for all functions
- No agent required
- No configuration needed
```
### Vulnerability Scoring
## Enabling Inspector
### For EC2 Instances
```bash theme={null}
# Enable Inspector for EC2 in account
aws inspector2 enable \
--resource-types EC2 \
--account-ids 123456789012
# Check status
aws inspector2 batch-get-account-status \
--account-ids 123456789012
# Get findings for EC2
aws inspector2 list-findings \
--filter-criteria '{
"resourceType": [{"comparison": "EQUALS", "value": "AWS_EC2_INSTANCE"}],
"severity": [{"comparison": "EQUALS", "value": "CRITICAL"}]
}'
```
### For ECR
```bash theme={null}
# Enable Inspector scanning for ECR
aws inspector2 enable \
--resource-types ECR
# Enable enhanced scanning for specific repo
aws ecr put-image-scanning-configuration \
--repository-name my-app \
--image-scanning-configuration scanOnPush=true
# Get ECR findings
aws inspector2 list-findings \
--filter-criteria '{
"resourceType": [{"comparison": "EQUALS", "value": "AWS_ECR_CONTAINER_IMAGE"}],
"severity": [{"comparison": "EQUALS", "value": "HIGH"}]
}'
# Get SBOM
aws inspector2 list-coverage \
--filter-criteria '{
"resourceType": [{"comparison": "EQUALS", "value": "AWS_ECR_CONTAINER_IMAGE"}]
}'
```
### For Lambda
```bash theme={null}
# Enable Inspector for Lambda
aws inspector2 enable \
--resource-types LAMBDA \
--account-ids 123456789012
# Lambda scanning is automatic - no additional config needed
# Get Lambda findings
aws inspector2 list-findings \
--filter-criteria '{
"resourceType": [{"comparison": "EQUALS", "value": "AWS_LAMBDA_FUNCTION"}],
"severity": [{"comparison": "EQUALS", "value": "CRITICAL"}]
}'
```
## Terraform Configuration
```hcl theme={null}
# Enable Inspector
resource "aws_inspector2_enabler" "main" {
account_ids = [data.aws_caller_identity.current.account_id]
resource_types = ["EC2", "ECR", "LAMBDA"]
}
# ECR repository with enhanced scanning
resource "aws_ecr_repository" "app" {
name = "my-application"
image_tag_mutability = "MUTABLE"
image_scanning_configuration {
scan_on_push = true
}
encryption_configuration {
encryption_type = "KMS"
kms_key = aws_kms_key.ecr.arn
}
tags = {
Environment = "production"
}
}
# Inspector delegated admin (for Organizations)
resource "aws_inspector2_delegated_admin_account" "main" {
account_id = "123456789012"
}
# Inspector member association
resource "aws_inspector2_member_association" "members" {
account_id = "111122223333"
}
# EventBridge rule for critical findings
resource "aws_cloudwatch_event_rule" "inspector_critical" {
name = "inspector-critical-findings"
description = "Capture critical Inspector findings"
event_pattern = jsonencode({
source = ["aws.inspector2"]
detail-type = ["Inspector2 Finding"]
detail = {
severity = ["CRITICAL"]
status = ["ACTIVE"]
}
})
}
resource "aws_cloudwatch_event_target" "notify" {
rule = aws_cloudwatch_event_rule.inspector_critical.name
target_id = "SendToSNS"
arn = aws_sns_topic.security_alerts.arn
}
# SNS topic for alerts
resource "aws_sns_topic" "security_alerts" {
name = "inspector-security-alerts"
}
resource "aws_sns_topic_subscription" "email" {
topic_arn = aws_sns_topic.security_alerts.arn
protocol = "email"
endpoint = "security-team@example.com"
}
```
## Finding Management
### Understanding Findings
```json theme={null}
{
"findingArn": "arn:aws:inspector2:us-east-1:123456789012:finding/...",
"awsAccountId": "123456789012",
"type": "PACKAGE_VULNERABILITY",
"description": "CVE-2024-12345 - Remote Code Execution in libssl1.1",
"severity": "CRITICAL",
"firstObservedAt": "2024-01-15T10:00:00.000Z",
"lastObservedAt": "2024-01-15T10:00:00.000Z",
"updatedAt": "2024-01-15T10:00:00.000Z",
"status": "ACTIVE",
"remediation": {
"recommendation": {
"text": "Update libssl1.1 to version 1.1.1w-0+deb11u1 or later",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12345"
}
},
"packageVulnerabilityDetails": {
"vulnerabilityId": "CVE-2024-12345",
"vulnerablePackages": [
{
"name": "libssl1.1",
"version": "1.1.1n-0+deb11u3",
"architecture": "amd64",
"packageManager": "APT"
}
],
"source": "NVD",
"cvss": {
"version": "3.1",
"baseScore": 9.8,
"scoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"referenceUrls": [
"https://nvd.nist.gov/vuln/detail/CVE-2024-12345"
]
},
"resources": [
{
"type": "AWS_EC2_INSTANCE",
"id": "i-1234567890abcdef0",
"details": {
"awsEc2Instance": {
"type": "t3.medium",
"platform": "UBUNTU_20_04",
"ipV4Addresses": ["10.0.1.50"]
}
}
}
],
"networkReachabilityDetails": {
"networkPath": {
"steps": [
{
"componentType": "INTERNET_GATEWAY"
},
{
"componentType": "SECURITY_GROUP",
"componentId": "sg-0123456789abcdef0"
}
]
},
"openPortRange": {
"begin": 443,
"end": 443
},
"protocol": "TCP"
},
"exploitAvailable": "YES",
"fixAvailable": "YES"
}
```
### Automated Remediation
```python theme={null}
import boto3
import json
inspector = boto3.client('inspector2')
ssm = boto3.client('ssm')
sns = boto3.client('sns')
def lambda_handler(event, context):
"""
Automated response to Inspector findings
"""
finding = event['detail']
severity = finding['severity']
resource_type = finding['resources'][0]['type']
if severity == 'CRITICAL' and finding['fixAvailable'] == 'YES':
if resource_type == 'AWS_EC2_INSTANCE':
remediate_ec2_vulnerability(finding)
elif resource_type == 'AWS_ECR_CONTAINER_IMAGE':
notify_container_vulnerability(finding)
elif resource_type == 'AWS_LAMBDA_FUNCTION':
remediate_lambda_vulnerability(finding)
def remediate_ec2_vulnerability(finding):
"""
Patch EC2 instance using Systems Manager.
This is the "golden path" for EC2 patching: Inspector detects the vuln,
EventBridge triggers this Lambda, and SSM Run Command applies the patch.
No SSH access needed, no bastion hosts, fully auditable.
Common mistake: patching without testing. In production, route the
SSM command to a staging instance first, verify the patch doesn't break
your application, THEN apply to production instances in a rolling fashion.
"""
instance_id = finding['resources'][0]['id']
vulnerability_id = finding['packageVulnerabilityDetails']['vulnerabilityId']
# Get affected package
vulnerable_pkg = finding['packageVulnerabilityDetails']['vulnerablePackages'][0]
package_name = vulnerable_pkg['name']
fixed_version = finding['remediation']['recommendation']['text']
# Run patch command via SSM
response = ssm.send_command(
InstanceIds=[instance_id],
DocumentName='AWS-RunPatchBaseline',
Parameters={
'Operation': ['Install']
},
Comment=f'Patching {vulnerability_id} - {package_name}'
)
command_id = response['Command']['CommandId']
# Notify team
notify_remediation(
finding,
f'Initiated patching on {instance_id}. SSM Command: {command_id}'
)
def notify_container_vulnerability(finding):
"""
Alert team about container vulnerability
"""
image_uri = finding['resources'][0]['id']
vulnerability_id = finding['packageVulnerabilityDetails']['vulnerabilityId']
cvss_score = finding['packageVulnerabilityDetails']['cvss']['baseScore']
message = {
'severity': finding['severity'],
'vulnerability': vulnerability_id,
'cvss_score': cvss_score,
'image': image_uri,
'action_required': 'Rebuild container image with updated base image',
'remediation': finding['remediation']['recommendation']['text']
}
sns.publish(
TopicArn='arn:aws:sns:us-east-1:123456789012:container-security',
Subject=f'CRITICAL: Container Vulnerability {vulnerability_id}',
Message=json.dumps(message, indent=2)
)
def remediate_lambda_vulnerability(finding):
"""
Update Lambda function dependencies
"""
function_arn = finding['resources'][0]['id']
function_name = function_arn.split(':')[-1]
vulnerability_id = finding['packageVulnerabilityDetails']['vulnerabilityId']
# Get Lambda function
lambda_client = boto3.client('lambda')
function = lambda_client.get_function(FunctionName=function_name)
message = {
'severity': finding['severity'],
'function': function_name,
'vulnerability': vulnerability_id,
'runtime': function['Configuration']['Runtime'],
'action_required': 'Update function dependencies and redeploy',
'remediation': finding['remediation']['recommendation']['text']
}
sns.publish(
TopicArn='arn:aws:sns:us-east-1:123456789012:lambda-security',
Subject=f'Lambda Vulnerability: {function_name}',
Message=json.dumps(message, indent=2)
)
def notify_remediation(finding, action_taken):
"""
Send notification about remediation action
"""
sns.publish(
TopicArn='arn:aws:sns:us-east-1:123456789012:security-remediation',
Subject=f"Inspector Remediation: {finding['packageVulnerabilityDetails']['vulnerabilityId']}",
Message=json.dumps({
'finding_arn': finding['findingArn'],
'severity': finding['severity'],
'vulnerability': finding['packageVulnerabilityDetails']['vulnerabilityId'],
'action_taken': action_taken
}, indent=2)
)
```
## Suppression Rules
```python theme={null}
import boto3
inspector = boto3.client('inspector2')
def create_suppression_rule():
"""
Suppress findings for dev environment
"""
response = inspector.create_filter(
action='SUPPRESS',
description='Suppress low severity findings in development',
filterCriteria={
'severity': [
{
'comparison': 'EQUALS',
'value': 'LOW'
}
],
'resourceTags': [
{
'comparison': 'EQUALS',
'key': 'Environment',
'value': 'development'
}
]
},
name='suppress-dev-low-severity',
reason='Low severity acceptable in dev environment'
)
return response
def suppress_specific_cve():
"""
Suppress specific CVE across all resources
"""
response = inspector.create_filter(
action='SUPPRESS',
description='Suppress CVE-2024-12345 - false positive',
filterCriteria={
'vulnerabilityId': [
{
'comparison': 'EQUALS',
'value': 'CVE-2024-12345'
}
]
},
name='suppress-cve-2024-12345',
reason='False positive - not applicable to our use case'
)
return response
```
## Multi-Account Setup
### Organization Integration
### Designate Delegated Administrator
```bash theme={null}
# From management account
aws inspector2 enable-delegated-admin-account \
--delegated-admin-account-id 123456789012
```
### Enable Auto-Enable
```bash theme={null}
# From delegated admin account
aws inspector2 update-organization-configuration \
--auto-enable '{
"ec2": true,
"ecr": true,
"lambda": true
}'
```
### Add Member Accounts
```bash theme={null}
# Associate member accounts
aws inspector2 associate-member \
--account-id 111122223333
aws inspector2 associate-member \
--account-id 444455556666
```
## Best Practices
Enable scanning for EC2, ECR, and Lambda for complete coverage
Use Systems Manager for automated EC2 patching
Generate and store SBOM for compliance and audit
Fail builds on critical vulnerabilities in containers
### Security Checklist
```yaml theme={null}
Inspector Best Practices:
Setup:
☐ Enable Inspector in all regions
☐ Configure delegated administrator
☐ Enable auto-enable for new accounts
☐ Set up EventBridge rules
Monitoring:
☐ Daily review of critical findings
☐ Weekly review of high severity
☐ Track patching metrics
☐ Monitor SBOM generation
Remediation:
☐ Automate EC2 patching where possible
☐ Set up container rebuild pipelines
☐ Update Lambda dependencies regularly
☐ Document suppression reasons
Compliance:
☐ Generate regular vulnerability reports
☐ Export SBOM for compliance
☐ Track time-to-remediation
```
## Cost Optimization
```yaml theme={null}
Pricing Model:
EC2 Scanning:
- $0.30 per instance per month
- Charged per active instance
# Cost tip: 100 EC2 instances = $30/month -- very reasonable
# compared to commercial vulnerability scanners at $5-15/instance
ECR Scanning:
- First scan per image: FREE
- Re-scan if pushed: FREE
- Continuous monitoring: $0.09 per image per month
# Cost tip: only enable continuous monitoring for production images.
# Dev/test images get scanned on push, which is usually sufficient.
Lambda Scanning:
- $0.60 per function per month
- Includes code and layers
# Cost tip: if you have 200 Lambda functions but only 30 are
# production-critical, use tags and Inspector filters to focus scanning.
Optimization Tips:
- Use tags to exclude dev resources from continuous scanning
- Create suppression rules for accepted risks (with documented justification)
- Disable scanning for deprecated resources pending decommission
- Export findings to S3 for long-term storage and trend analysis
- Track mean-time-to-remediation (MTTR) as a KPI -- aim for <7 days for critical
```
## Exam Tips
* Inspector scans **EC2, ECR, Lambda** for vulnerabilities
* Uses **CVE database** and **SBOM** analysis
* Provides **CVSS scores** and **network reachability** context
* **Automatic** for Lambda and ECR (when enabled)
* Requires **SSM Agent** for EC2 scanning
* Integrates with **Security Hub** for centralized findings
* **EventBridge** for automated response
* **Suppression rules** for false positives
**Q: How to scan EC2 instances for vulnerabilities?**
A: Enable Inspector and ensure SSM Agent is installed on instances
**Q: How to automatically patch EC2 vulnerabilities?**
A: EventBridge → Lambda → Systems Manager Run Command
**Q: How to scan container images?**
A: Enable Inspector ECR scanning with scan-on-push
**Q: How to centralize vulnerability findings?**
A: Use delegated administrator with Security Hub integration