How does AWS Inspector decide what to scan and how do findings flow into remediation?
⚡
Quick Answer
Inspector continuously and automatically scans ECR images, Lambda functions and EC2 instances (EC2 needs the SSM agent).
Detailed Answer
Inspector continuously and automatically scans ECR images, Lambda functions and EC2 instances (EC2 needs the SSM agent). Its risk score blends CVSS with exploitability and network reachability, so an unreachable vuln ranks below an internet-exposed one. Findings publish to Security Hub and EventBridge, so remediation is automated — an EventBridge rule can trigger a patch job, open a ticket, or block promotion of a failing image.
Code Example
# Deep-dive: AWS Inspector # continuous scanning of EC2, Lambda and ECR images, the SSM agent dependency for EC2, network reachability analysis, the Inspector risk score vs raw CVSS, suppression rules, and routing findings into Security Hub or EventBridge # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
💡
Interview Tip
This is where depth shows — be concrete about AWS Inspector, not generic about "security".
inspectordevsecopsdeep-dive