Amazon Inspector automatically scans supported AWS workloads across an organization, while AWS Security Hub helps teams review and prioritize the findings. Some scan types rescan continuously; others use resource-specific intervals or scan-on-push settings. Reliable coverage depends on enabling the right scan types in every account and Region, then checking which resources are actually eligible.

AWS Security Hub is now a broader security operations experience that correlates signals from services such as Amazon Inspector, GuardDuty, Security Hub Cloud Security Posture Management (Security Hub CSPM), and Macie. Security Hub CSPM remains the posture management capability that receives Inspector findings. This guide focuses on Inspector scanning and that finding integration; the broader Security Hub experience can add correlated exposure views.

What Amazon Inspector scans

Amazon Inspector does not use manually scheduled assessment targets. Activate a scan type for an account and Region, and Inspector automatically scans supported resources. The scan method and eligibility rules depend on the resource:

Resource What Inspector checks Coverage detail
Amazon EC2 Software package vulnerabilities, network exposure, and network reachability. Agent-based package scanning uses the Systems Manager Agent to collect inventory from eligible managed instances. Hybrid scanning can also use EBS snapshots for eligible instances that are not managed by Systems Manager. Network reachability checks run separately from package scans.
Amazon ECR Package vulnerabilities in container images stored in private ECR repositories. Use Amazon ECR enhanced scanning with Inspector and choose continuous scanning or scan-on-push. Only eligible, active images within the configured re-scan period are monitored; basic manual scans are a different mode.
AWS Lambda Third-party package vulnerabilities in function dependencies and, optionally, code vulnerabilities in the function. Standard scanning covers supported $LATEST functions invoked or updated within the last 90 days. Lambda code scanning is an optional scan type. It differs from the separate Inspector Code Security capability for repositories; Inspector Code Security findings are not sent through the Security Hub CSPM integration.

Review the current Inspector scan types, EC2 scan methods, ECR scanning behavior, and Lambda scanning eligibility before choosing coverage. On first activation, Inspector may enable EC2, ECR, and Lambda standard scanning by default; Lambda code scanning is optional.

Plan account and Region coverage

Set up Inspector administration

Amazon Inspector is Regional. Choose the AWS accounts and Regions that contain the workloads you need to scan. Designate the same member account as Inspector's delegated administrator in each Region where you use the service; registering the delegated administrator in one Region does not register it in every other Region. Your organization must use all features in AWS Organizations.

For centralized, repeatable enrollment, AWS recommends managing Inspector with AWS Organizations policies. Designate the Inspector administrator first, then apply a policy for the scan types and organizational accounts or units you want covered. Policies can automate enablement for current and new organization accounts across Regions, and policy-managed scan types take precedence over conflicting account-level enablement. The delegated administrator still controls other Inspector settings.

If you are not using organization policies, the delegated administrator can activate Inspector for selected member accounts from the Inspector console's Account management page. Use the Region selector, enable the required scan types, and turn on automatic activation for new member accounts. Repeat the enrollment and new-account setting in every Region in scope. See AWS's guide to activating member-account scans for the current console and API steps.

Inspector creates the AWSServiceRoleForAmazonInspector2 service-linked role when you activate it; Security Hub CSPM creates AWSServiceRoleForSecurityHub when you enable it. You do not need to create either role manually. The IAM identity used for setup still needs the permissions AWS requires to designate administrators, enable the services, and create their service-linked roles. See the current AWS guides for Inspector service-linked roles and Security Hub CSPM service-linked roles.

Enable Security Hub CSPM for findings

Enable Security Hub CSPM in the same accounts and Regions where Inspector runs. Once CSPM is enabled, its Inspector integration activates automatically and Inspector findings are sent in AWS Security Finding Format. There is no separate integration toggle. CSPM receives findings generated after it is enabled; it does not backfill findings from before enablement. The integration does not include findings from Amazon Inspector Code Security.

For an organization, Inspector's delegated administrator does not automatically configure CSPM membership. When managing the services directly, designate a CSPM delegated administrator and use central configuration policies to enable CSPM and set standards and controls for selected accounts or organizational units across the home Region and linked Regions. These policies are created from the home Region. If your team uses the expanded AWS Security Hub console, its configuration catalog can apply organization policies for Amazon Inspector's vulnerability-management capabilities and deployments for CSPM.

Do not treat Region aggregation as service enablement. Security Hub CSPM's cross-Region aggregation copies findings and related data to a home Region only from Regions where CSPM is already enabled. It does not turn CSPM on in those Regions. Use central configuration to manage organization settings and cross-Region aggregation to consolidate regional results.

For the service integration prerequisites and the exact findings it transfers, see the Amazon Inspector and Security Hub CSPM integration guide. AWS's overview of the expanded Security Hub explains how it relates Inspector findings to other security signals.

Verify scan coverage

After activation, review Inspector coverage by account, Region, and resource type. An enabled scan type does not mean every resource is being scanned. Check for:

  • EC2: supported operating system and scan method; for agent-based scanning, a healthy Systems Manager-managed instance. In hybrid mode, confirm an unmanaged instance meets Inspector's agentless EBS and size requirements.
  • ECR: enhanced scanning is enabled for the intended private repositories, the scan frequency is continuous or scan-on-push as planned, and images are active and inside the re-scan period.
  • Lambda: supported runtime and a function version that is eligible for scanning; idle functions can leave coverage after 90 days.
  • Organization and Regions: every intended account is associated with Inspector and has the required scan types enabled in each target Region. Check new-account enrollment separately if you use manual activation.

Use the Inspector console's coverage view or the ListCoverage API to investigate gaps. AWS documents the available statuses in its guide to assessing Inspector coverage.

In Security Hub CSPM, filter findings by product and account to confirm Inspector results arrive in the expected Regions. If you use a home Region, confirm the linked Regions are included in the aggregation configuration. Remember that findings are regional until CSPM is enabled there and aggregation is configured.

Review findings

Prioritize findings using severity together with resource importance, exploitability, network exposure, and the package or image involved. The expanded AWS Security Hub can correlate Inspector vulnerabilities with threat and configuration signals to show broader exposures; Inspector's own coverage view remains the place to check whether resources are being scanned.

Fix vulnerabilities through a tested workflow

Security Hub CSPM automation rules update finding fields or suppress matching findings. Changing a finding's workflow status does not patch software or change the affected resource. To remediate, connect a finding to a deliberate response workflow, such as a tested Systems Manager Automation runbook for a supported patch or a deployment process that rebuilds an ECR image or Lambda package. Apply least-privilege permissions, test the action before broad rollout, and verify the resource changed and Inspector reevaluated it. Amazon Inspector can publish findings to EventBridge for routing to these workflows; EventBridge does not supply a fix by itself.

For a closer look at the separate finding-triage role of rules, read How Automation Rules Work in AWS Security Hub.

Conclusion

Automating Inspector across accounts means planning scan types and Regions, applying organization-wide enrollment, and checking actual coverage for EC2, ECR, and Lambda. Enable Security Hub CSPM separately where you want Inspector findings, and configure aggregation only when you need a consolidated regional view. Keep finding organization and resource remediation as separate steps so a status change is never mistaken for a repaired workload.