AWS Amazon Inspector and How to use Amazon Inspector
Amazon Inspector
Amazon Inspector secures active containers by linking Amazon ECR images.
What's Amazon Inspector?
AWS Amazon Inspector automatically detects software bugs and unintended network exposure in AWS workloads. It provides large-scale automated vulnerability management.
How to utilise Amazon Inspector
Amazon Inspector scans several AWS workloads, including:
Amazon EC2 instances, Lambda functions, ECR container images, and CI/CD technologies are examples.
It finds unintended network exposure and software bugs in these resources.
Container Security Enhancements:
Recent improvements to AWS Amazon Inspector boost container security. It adds two container image management capabilities:
Links Amazon ECR images to active containers: This method lets security teams rate vulnerabilities by whether your environment hosts Amazon ECR images. Amazon ECS and EKS containers can detect running images and their deployment locations. It also provides the cluster Amazon Resource Name (ARN) and the number of EKS pods or ECS tasks where an image is installed to aid in prioritisation by usage and severity.
Increase vulnerability scanning support: Amazon Inspector supports Scratch, distroless, and Chainguard basic base images for vulnerability scanning. Support for Puppeteer, WordPress (core, themes, and plugins), Amazon Corretto, Apache Tomcat, Apache httpd, Oracle JDK & JRE, and the Go toolchain is also added. It provides consistent vulnerability assessments for minimum base images and typical Linux distributions through a single service.
How Container Mapping Works:
Container mapping lets teams see which container images are operating in their environment. Container images are monitored regularly to do this.
This feature requires sophisticated scanning in the Amazon ECR console. In the AWS Amazon Inspector console, you may specify image re-scan mode by last pull or last in-use date. Last-used date is used by default. If images were shot within 14 days, you can pick how long Inspector will monitor them.
Container image lifetime aspects that can be monitored include:
Image push date (14, 30, 60, 90, 180, or lifetime).
Image capture date (14, 30, 60, 90, 180 days)
Instead of never, 14–180 days
Image state in container
Amazon EKS and ECS workloads default to 14 days for last in use, push, and pull for new clients. Businesses can alter their monitoring to reflect container image consumption rather than repository events.
Prioritising and Finding Details:
To aid cleanup, AWS Amazon Inspector now includes image runtime-aware data in every finding. The lastInUseAt date and the number of deployed EKS pods or ECS tasks using the image are included.
In the Details menu of the Inspector console, you can see the number of EKS pods or ECS tasks, last in-use, and pull dates for container images. The cluster ARN, latest use dates, and sort of each image are presented when the count is selected.
You can filter photographs by their last running date within 14, 30, 60, or 90 days or by the lastInUseAt field using rolling window or fixed range settings in findings reports. This helps prioritise cleanup by usage.
Visibility Between Accounts:
AWS Amazon Inspector supports security management for delegated administrator, cross-account, and single AWS accounts. It shares container image data inside the firm. All ARNs for Amazon EKS and Amazon ECS clusters with images are provided for complete visibility across multiple AWS accounts. Daily updates are made to deployed EKS pods and ECS tasks as accounts join or leave the enterprise.
Amazon Inspector benefits:
Find software bugs
Use Amazon EC2, Lambda functions, and container images in Amazon ECR and CI/CD technologies to find software bugs and inadvertent network exposure in real time.
Manage SBOM exports centrally
Manage SBOM exports for all monitored resources centrally and add security early in development.
Prioritise cleanup
Prioritise remediation using the AWS Amazon Inspector risk score to reduce MTTR.
Increase vulnerability evaluations' coverage
Easily switch between agent-based and agentless EC2 scanning.
Amazon Inspector Use Cases
Quickly find computational workload zero-day vulnerabilities
You can automate discovery, expedite vulnerability routing, and reduce MTTR using over 50 vulnerability intelligence sources.
Prioritise patch repair
To rank and fix vulnerable resources, contextual risk ratings use network accessibility and CVE data.
Meet compliance standards
AWS Amazon Inspector scans support NIST CSF, PCI DSS, and other regulatory compliance and best practices.
Early in development, change security
Export an aggregated SBOM for the observed resources and incorporate vulnerability scanning in developer tools.
Prices on Amazon Inspector
Container mapping is now available in all Amazon Inspector-accessible AWS regions. These new features are free. Amazon Inspector offers a 15-day free trial for new accounts. The Amazon Inspector pricing page lists regional availability and costs.
AWS Inspector is an automated vulnerability management tool that checks various AWS workloads. Container images in Amazon ECR, ECS, and EKS were added recently. Runtime awareness and cross-account visibility assist prioritise remediation.
