# Amazon Inspector Cloud service · AWS. Updated 2026-10-29. Page: https://blowstack.com/tools/cloud-services-hub/amazon-inspector > Amazon Inspector is a security assessment service offered by Amazon Web Services (AWS) that automatically assesses applications for vulnerabilities or deviations from best practices, and produces a detailed list of security findings prioritized by level of severity. Practice exams covering Amazon Inspector: [AIF-C01 AWS Certified AI Practitioner](https://blowstack.com/practice-exams/aws-certified-ai-practitioner), [CLF-C02 AWS Certified Cloud Practitioner](https://blowstack.com/practice-exams/aws-certified-cloud-practitioner), [SOA-C03 AWS Certified CloudOps Engineer - Associate](https://blowstack.com/practice-exams/aws-certified-cloudops-engineer-associate), [DOP-C02 AWS Certified DevOps Engineer - Professional](https://blowstack.com/practice-exams/aws-certified-devops-engineer-professional), [MLA-C02 (beta) AWS Certified Machine Learning Engineer - Associate](https://blowstack.com/practice-exams/aws-certified-machine-learning-engineer-associate), [SCS-C03 AWS Certified Security - Specialty](https://blowstack.com/practice-exams/aws-certified-security-specialty), [SAA-C03 AWS Certified Solutions Architect - Associate](https://blowstack.com/practice-exams/aws-certified-solutions-architect-associate), [SAP-C02 AWS Certified Solutions Architect - Professional](https://blowstack.com/practice-exams/aws-certified-solutions-architect-professional). ## 4 key features of Amazon Inspector Amazon Inspector offers automated vulnerability management, continuous scanning, integration with AWS services, comprehensive reporting, and customizable rule packages for effective security assessments. 1. **Automated Vulnerability Management**: Amazon Inspector automatically assesses applications for vulnerabilities or deviations from best practices, including network accessibility and common vulnerabilities and exposures (CVEs) in the Amazon EC2 instances. 2. **Continuous Scanning**: Amazon Inspector continuously scans the AWS environment to identify software vulnerabilities and unintended network exposure, ensuring that risks are identified as soon as they arise. 3. **Integrated AWS Services**: Integrates with AWS Security Hub and Amazon EventBridge to automate workflows and ticket routing. 4. **Comprehensive Reporting**: Provides detailed findings of the security assessment, including severity levels and remediation steps, to help prioritize and manage security issues effectively. ## Where Amazon Inspector is used Amazon Inspector is used for vulnerability management, compliance assurance, DevSecOps integration, and automated security assessments to enhance the security and compliance posture of AWS workloads. 1. **Vulnerability Management**: Amazon Inspector is used to automatically scan AWS workloads for vulnerabilities and unintended network exposures. Organizations can leverage this capability to continuously monitor and rectify security vulnerabilities in their AWS resources, ensuring compliance with their security policies and standards. 2. **Compliance Assurance**: Supports compliance requirements and best practices for NIST CSF, PCI DSS, and other regulations through Amazon Inspector scans. 3. **DevSecOps Integration**: Amazon Inspector can be seamlessly integrated into CI/CD pipelines to automatically assess application security as part of the development process. This enables developers and security teams to address vulnerabilities early in the development lifecycle, promoting a culture of security and operational excellence. 4. **Automated Security Assessments**: Organizations can use Amazon Inspector to automate the process of security assessment reporting. By scheduling regular scans, users can receive reports detailing the security health of their AWS environment, enabling proactive risk management and mitigation strategies. ## How Amazon Inspector is priced Amazon Inspector pricing varies between agent-based assessments for EC2 instances or servers, and event-based assessments for AWS resources like Lambda functions and containers without installing agents. - **Amazon EC2 instance scans**: Charged by the average number of EC2 instances assessed during the month, for both agent-based and agentless scanning. Intermittently running instances are prorated by their total running time. - **Amazon ECR container image scans**: Charged for the number of images initially scanned when pushed to ECR and the number of image rescans performed each month. - **Amazon EC2 CIS Benchmark assessments**: Charged per assessment per EC2 instance. - **On-demand container image scanning**: Charged by the number of container images scanned per month, including scans within CI/CD tools and on-demand scans outside those tools. - **AWS Lambda standard scans**: Charged by the average number of Lambda functions scanned per month, prorated by Inspector coverage hours from discovery until deletion or exclusion from scanning. - **AWS Lambda code scans**: Charged by the average number of Lambda functions scanned per month, prorated by Inspector coverage hours from discovery until deletion or exclusion from scanning. - **Code repository scans**: Charged by the total number of scans across repositories for each supported scan type: first-party code (SAST), third-party dependencies (SCA), and infrastructure as code (IaC). - **Microsoft Azure Virtual Machine scans**: Charged by the average number of Azure VMs assessed per month, with intermittently running VMs prorated by total running time. - **Microsoft Azure Container Registry image scans**: Charged for the number of images initially scanned when pushed to ACR and the number of image rescans performed each month. - **Microsoft Azure Function App scans**: Charged by the average number of Azure Function Apps scanned per month, prorated by Inspector coverage hours. ## Services Amazon Inspector works with - **[AWS Security Hub](https://blowstack.com/tools/cloud-services-hub/aws-security-hub)**: Amazon Inspector findings are automatically sent to AWS Security Hub, where you can aggregate the findings from various AWS security services into a consistent format for easier management and remediation. - **[AWS Organizations](https://blowstack.com/tools/cloud-services-hub/aws-organizations)**: Amazon Inspector integrates with AWS Organizations, enabling you to manage and delegate responsibilities, such as security assessments, across multiple AWS accounts in an organization. - **[AWS Lambda](https://blowstack.com/tools/cloud-services-hub/aws-lambda)**: Amazon Inspector integrates with AWS Lambda to automate responses to findings. For instance, you can create Lambda functions that automatically remediate specific types of vulnerabilities when detected by Amazon Inspector. ## What is Amazon Inspector Amazon Inspector is a security vulnerability assessment service designed to help organizations enhance the security and compliance of their applications deployed on Amazon Web Services (AWS). As businesses increasingly move their operations to the cloud, ensuring the security of their applications and data becomes paramount. Amazon Inspector automates the security assessment process by scanning AWS resources for vulnerabilities or deviations from best practices. One of the core strengths of Amazon Inspector is its deep integration with AWS, enabling it to effortlessly assess the configuration and behavior of AWS resources. It works by analyzing the application's network accessibility, identifying the vulnerabilities or deviations, and then providing detailed findings. These findings are accompanied by a severity rating, which helps organizations prioritize issues based on their potential impact on the security posture. This comprehensive analysis is critical in todays fast-evolving threat landscape, allowing businesses to proactively identify and mitigate vulnerabilities before they can be exploited. Amazon Inspector automatically rescans affected resources when events may introduce a new vulnerability, including package installations, patches, and publication of a new common vulnerabilities and exposures (CVE) entry that affects the resource. Amazon Inspector is designed with simplicity in mind. Setting up and starting the assessments can be done with just a few clicks in the AWS Management Console. Once an assessment is initiated, Amazon Inspector examines the application's runtime environment, checking for vulnerabilities and identifying unauthorized network access or the use of outdated software versions that could expose the application to security threats. Moreover, Amazon Inspector offers detailed recommendations on how to address the identified issues. These recommendations are actionable, allowing developers and security teams to clearly understand the steps needed to remediate vulnerabilities, ultimately enhancing the security posture of their applications. Using Amazon Inspector, organizations can automate regular security assessments, thereby continuously monitoring their AWS resources for vulnerabilities. This continuous monitoring is essential for maintaining compliance with industry regulations and standards, as it ensures that security is not just a one-time check but an ongoing process. In summary, Amazon Inspector is an essential service for any organization deploying applications on AWS, offering comprehensive, automated security assessments that adapt to the latest threat landscape. By simplifying the process of identifying and remediating vulnerabilities, Amazon Inspector enables businesses to more effectively protect their applications and data against current and emerging security threats. ## Concepts related to Amazon Inspector - [Attack Surface Reduction](https://blowstack.com/tools/cloud-concepts-hub/attack-surface-reduction): Attack Surface Reduction is the practice of removing unnecessary entry points and access paths that attackers could use to reach or compromise systems. - [OS Hardening](https://blowstack.com/tools/cloud-concepts-hub/os-hardening): OS hardening is the process of reducing an operating system’s attack surface and enforcing secure configurations to limit compromise and its impact. - [Patch Management](https://blowstack.com/tools/cloud-concepts-hub/patch-management): Patch management is the controlled process of identifying, testing, deploying, and verifying software updates to reduce vulnerabilities and maintain reliable systems. - [Runtime Threat Detection](https://blowstack.com/tools/cloud-concepts-hub/runtime-threat-detection): Runtime Threat Detection identifies potentially malicious activity by observing workloads and their behavior while they execute. - [Security Quality Gates](https://blowstack.com/tools/cloud-concepts-hub/security-quality-gates): Security quality gates are enforced checkpoints that allow software changes to advance only when defined security acceptance criteria are satisfied. - [Shift-Left Security](https://blowstack.com/tools/cloud-concepts-hub/shift-left-security): Shift-left security integrates security design, testing, and remediation into the earliest practical stages of software development and delivery. - [Stateful and Stateless Filtering](https://blowstack.com/tools/cloud-concepts-hub/stateful-and-stateless-filtering): Stateful and stateless filtering are approaches to permitting or blocking network packets based on either tracked connection context or independent packet-by-packet rules. - [Vulnerability Assessment](https://blowstack.com/tools/cloud-concepts-hub/vulnerability-assessment): Vulnerability assessment is the systematic identification, evaluation, and prioritization of security weaknesses in systems, software, and configurations.