Inspector
Amazon Inspector in Prism centralizes software vulnerability management across every AWS account in your organization. From a single interface, you can see which CVEs are most prevalent across your estate, browse findings by account, severity and status, choose which kinds of resource are scanned, manage which accounts are enrolled, and confirm that every account still carries the permissions Inspector needs.
What is Inspector?
Amazon Inspector is a vulnerability management service that continuously scans your workloads for known software vulnerabilities (CVEs), insecure code, and unintended network exposure. It discovers resources automatically as they appear, so a newly launched EC2 instance or a freshly pushed container image is scanned without anyone enabling anything for it.
Prism enables Inspector independently in every enrolled account, using that account's own access role.
Inspector has no delegated administrator. Unlike Security Hub CSPM, GuardDuty, and Macie, Amazon Inspector in Prism uses a flat peer model: no account is privileged over any other, there is no administrator account to nominate, no invitations are sent, and no AWS management-account access is ever required. Each account is enabled standalone, and Prism, not AWS, aggregates the results for the dashboard.
Key capabilities include:
- Cross-account CVE aggregation, Every enrolled account is scanned independently, and Prism combines the results into one estate-wide view with a Top CVEs table ranked by how many findings each CVE accounts for
- Five selectable scan types, Choose which resource kinds Inspector scans, EC2 instances, ECR container images, Lambda function dependencies, Lambda function code, and code repositories. This is the main cost control
- Severity breakdown including UNTRIAGED, Six severity tiles covering Critical, High, Medium, Low, Informational, and Untriaged
- Fix availability, See at a glance how many findings already have a vendor fix published, so you can prioritise the vulnerabilities you can actually remediate today
- Per-account and per-type breakdowns, Drill from an account or a finding type straight into the matching findings
- Remediation guidance, Findings carry AWS's remediation text and, where one exists, a link to the vendor or AWS advisory. Package and code vulnerabilities also carry a CVE identifier and an Inspector score; network-reachability findings carry neither
- No root emails required, Because there is no invitation flow, enrollment never needs a member account's AWS root email address
Navigation
The Inspector section is accessible from the Security Hub sidebar under Amazon Inspector. It has four areas:
| Section | Description |
|---|---|
| Dashboard | Severity tiles, coverage stats, Top CVEs, findings by type, and the per-account breakdown |
| Findings | Browse and filter Inspector vulnerability findings |
| Enrollment | Add, remove, and retry accounts |
| Settings | Manage scan types, linking regions, account permissions, and disable Inspector |
When Inspector has not been configured yet, the sidebar shows a single Enable Amazon Inspector row instead of the dashboard and its sub-pages. Clicking it opens the setup wizard.
Enrollment Is Per Account, and Partial Success Is Normal
Because each account is enabled on its own, accounts succeed and fail independently. It is an ordinary outcome for most accounts to enrol while a few do not, for example because Inspector is unavailable in a selected region, or because an account's access role has not yet received the permissions Prism attaches.
When that happens the configuration settles in partial failure rather than failing outright. The accounts that enrolled are live and producing findings; the ones that did not are listed on the Enrollment page with their error and a Retry button. If the cause is missing permissions, the Permissions tab in Settings scans every account and offers a Fix roles action that re-applies the policy.
Partial failure is a state you act on, not an error that undoes your setup. Nothing is rolled back, and retrying an account never disturbs the accounts that already succeeded.
Cost & Billing
Amazon Inspector bills per resource scanned, so your cost is driven by which scan types you enable and how many matching resources exist across your enrolled accounts and regions.
| Scan type | What it scans | Indicative cost |
|---|---|---|
| EC2 instances | Operating-system and application packages on running instances, plus unintended network exposure | ≈ $1.26 per instance / month |
| ECR container images | Packages inside images in Amazon ECR, re-scanned as new CVEs are published | ≈ $0.09 per initial image scan |
| Lambda functions — dependencies | The deployed package and its layers, for vulnerable third-party dependencies | ≈ $0.30 per function / month |
| Lambda functions — your code | The function's own source, for insecure code such as injection, hard-coded secrets, and weak crypto | ≈ $0.90 per function / month |
| Code repositories | Connected source repositories, for insecure code, exposed secrets, and vulnerable dependencies declared in their manifests | See AWS Inspector pricing |
The scan-type selection is a live cost decision, not a display preference. Turning a scan type on starts both its scanning and its charges in every enrolled account and linking region; turning it off stops both. Enable only the resource kinds you actually need covered. The two Lambda scan types are billed and enabled separately, see Enabling Inspector.
Prices above are indicative us-east-1 list prices, shown for guidance on both the setup wizard's Scan types step and the Scan types tab in Settings. Consult the AWS Inspector pricing page for authoritative and region-specific rates.
Prerequisites
Before using Inspector, ensure the following:
- Your organization has been onboarded to Prism by CloudKeeper
- Security Hub has been enabled for your organization as a beta feature by CloudKeeper
- Security Hub access enabled for your account by an Admin in Preferences > Admin Management
- At least one AWS account is onboarded in Prism
Unlike GuardDuty and Macie, you do not need to nominate an administrator account or know any member account's AWS root email address.
Related Pages
- Enabling Inspector, Run the four-step setup wizard
- Dashboard, Read severity tiles, coverage, and Top CVEs
- Findings, Browse and filter vulnerability findings
- Enrollment, Manage which accounts are scanned
- Settings, Manage scan types, regions, permissions, and disable Inspector
- Configuration, Enable Inspector as an additional engine
- Security Hub Issues, Troubleshooting enrollment and findings problems