# Amazon Inspector

> An AWS service that keeps scanning your servers and code for known vulnerabilities.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/amazon-inspector/
- In Spanish: [Amazon Inspector](https://tidbit.legios.com.ar/es/amazon-inspector/)

**Amazon Inspector** is AWS's vulnerability management service. It looks at the software running in your account and checks it against databases of known security holes, the CVEs. If a server has an old version of a library with a published flaw, Inspector tells you.

It discovers what to scan on its own: EC2 instances, container images stored in Amazon ECR, and Lambda functions. You do not schedule scans. It rescans when something changes, such as a new package being installed, or when a new CVE is published that affects software you already run. For EC2 it also checks network reachability, flagging, for example, a port that is open to the internet when it probably should not be.

Each issue becomes a **finding** with the affected resource, a severity score and how to fix it, usually which version to upgrade to. When you patch, Inspector notices and closes the finding. Its results also flow into AWS Security Hub, where they are combined with other signals.

## An analogy

A building inspector who never leaves, rechecks every apartment whenever a new appliance is installed, and reads the recall notices each morning to see if anything in the building is on the list.

## Keep in mind

- Scans EC2 instances, ECR container images and Lambda functions.
- Rescans automatically when software changes or a new CVE appears.
- Each finding includes severity and a suggested fix.
- Closes findings by itself once the vulnerability is patched.

## Go deeper

- [What is Amazon Inspector? (official docs)](https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html)
- [Amazon Inspector product page](https://aws.amazon.com/inspector/)

## Related terms

- [Vulnerability and CVE](https://tidbit.legios.com.ar/vulnerability-and-cve/): A flaw that lets an attacker misuse software, and the public id that names it.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Amazon EC2](https://tidbit.legios.com.ar/amazon-ec2/): Virtual computers you rent by the hour, in any size, and switch off when done.
- [Container](https://tidbit.legios.com.ar/container/): A sealed box with a program and everything it needs to run anywhere.
- [Amazon ECR](https://tidbit.legios.com.ar/amazon-ecr/): A private warehouse on AWS for your container images, ready to be deployed.
- [AWS Lambda](https://tidbit.legios.com.ar/aws-lambda/): Run a piece of code only when something happens, with no server to manage.
- [Port](https://tidbit.legios.com.ar/port/): The numbered door on a computer that says which program a connection is for.