What is Amazon Inspector? A plain-English explainer

What Inspector actually scans for

Inspector looks for two related but distinct kinds of problem. The first is software vulnerabilities: known weaknesses (tracked as CVEs — publicly catalogued security flaws) in the operating system packages or application dependencies running on your EC2 instances, inside your container images, or bundled into your Lambda function code. The second is network reachability: whether a resource is exposed to more of the network — the internet, in the worst case — than it needs to be, which matters because an exposed vulnerable resource is a far more urgent problem than the same vulnerability on something unreachable.

Crucially, Inspector runs continuously rather than as a point-in-time check. When a new vulnerability is publicly disclosed for software you are already running, Inspector re-evaluates your existing resources against it automatically, without you having to remember to re-scan.

Inspector versus GuardDuty

This is the distinction most worth getting right, because the two services sound similar but answer different questions. Amazon Inspector finds vulnerabilities and misconfigured exposure in the resources you own — it tells you what could be exploited, before anyone has tried. Amazon GuardDuty detects active threats and suspicious behaviour — it tells you when something looks like it is actually happening, by analysing signals such as network traffic patterns and account activity for signs of compromise. Our what-is-amazon-guardduty explainer covers that side in more depth.

Put another way: Inspector is preventative — reduce the number of weaknesses an attacker could use. GuardDuty is detective — notice when an attacker appears to be using one. A mature security setup on AWS typically runs both, because closing vulnerabilities and detecting active threats are complementary, not overlapping, jobs.

• Amazon Inspector — finds vulnerabilities and exposure in your resources (preventative)
• Amazon GuardDuty — detects active threats and suspicious behaviour (detective)
• Both matter; neither replaces the other

What it scans, and common uses

Inspector covers EC2 instances (their operating system and installed software), container images stored in Amazon ECR (scanned as part of the image lifecycle, catching problems before a vulnerable image is even deployed), and Lambda functions (their code and dependencies). Findings are prioritised by severity, so a security team can focus first on the vulnerabilities that are both serious and reachable, rather than working through every finding in the order it was discovered.

A common pattern is wiring Inspector’s findings into a broader security dashboard, alongside other AWS security services, so a team has one place to see vulnerability status across their whole account rather than checking each workload type separately.

How you pay for it, without the numbers

Inspector follows a consumption-based model: you are charged based on the number and type of resources it scans (instances, images, functions) rather than a flat licence fee, and continuous scanning means the cost tracks how much you are running, not how often you choose to check. Exact rates change over time, so this article deliberately does not list them — check AWS’s Inspector pricing page for current detail.

Where Inspector appears in certification study

Inspector is most heavily tested on AWS Certified Security – Specialty, which expects you to distinguish it clearly from GuardDuty and to know which service answers which kind of security question. AWS Certified Solutions Architect – Associate and AWS Certified CloudOps Engineer – Associate cover it at a lighter, operational level, as part of the wider set of tools for keeping running workloads secure.

This article covers what Inspector is and how it differs from GuardDuty — the deeper detail of scan configuration and finding remediation belongs in the syllabus itself. Our /revision study library breaks that down lesson by lesson for the certifications below.