Amazon Inspector
Amazon Inspector is a cloud security service that automatically discovers workloads and code repositories, then scans them for software vulnerabilities and u…
What Amazon Inspector is
Amazon Inspector is a cloud security service that automatically discovers workloads and code repositories, then scans them for software vulnerabilities and unintended network exposure. It covers Amazon EC2 instances, Amazon ECR container images, AWS Lambda functions, code repositories, and supported Microsoft Azure resources. For EC2, scans can use AWS Systems Manager Agent or an agentless assessment. Inspector calculates contextualized risk scores using CVE information together with network access and exploitability factors. Findings appear in its console, can route to AWS Security Hub and Amazon EventBridge, and container findings can also go to Amazon ECR. AWS Organizations integration supports delegated administration and consolidated findings across member accounts. Jenkins and TeamCity integrations assess container images, while GitHub and GitLab integrations identify vulnerabilities and misconfigurations in source code, dependencies, and infrastructure as code. SBOM exports go to a configured S3 bucket. A 15-day free trial is listed, with pay-as-you-go billing afterward and no free plan.
Good
- Scans AWS, Azure, repositories, containers, and Lambda
- Contextualized risk scores prioritize findings
- Supports agent-based and agentless EC2 scanning
- Integrates with Security Hub and EventBridge
- Exports consolidated software bills of materials
Watch out
- No ongoing free plan
- Repository billing counts large repositories multiple times
- CIS Benchmark assessments excluded from 15-day trial
Who it suits
Amazon Inspector is intended for security teams and developers securing AWS infrastructure workloads and managing compliance. It also suits organizations scanning Azure resources, repositories, containers, and CI/CD environments.
Verdict
Amazon Inspector covers diverse cloud workloads and development sources with risk prioritization and integrations. Review trial exclusions and repository billing rules before deployment.
Plans and prices
From Amazon Inspector's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| 15-day free trial | Free | New Amazon Inspector accounts · one-time free usage for 25 on-demand CI/CD image assessments · 15 days for eligible scans; CIS Benchmark assessments excluded. |
| Azure scanning free trial | Free | Azure vulnerability scanning · 30 days after setting up Microsoft Azure integration. |
| Amazon Inspector pay-as-you-go | — | EC2 instances · ECR container images · Lambda functions · code repositories · Azure workloads · Monthly, based on workloads scanned; no minimum fees or upfront commitments. |
The facts
Each one read from Amazon Inspector's own pages, with the date it was checked.
What it does
- Code repository integrations
- The FAQ describes native integrations with GitHub and GitLab for identifying and prioritizing vulnerabilities and misconfigurations in source code, dependencies, and infrastructure as code.checked 5 Oct 2026
- Compliance use
- AWS says Inspector scans can support requirements and best practices including NIST CSF and PCI DSS.checked 5 Oct 2026
- Developer tools
- Inspector integrates with Jenkins and TeamCity for container image assessments, and CI/CD tools can be hosted in AWS, on premises, or in hybrid clouds.checked 5 Oct 2026
- Integrations
- Findings are aggregated in the Inspector console, routed to AWS Security Hub, and pushed through Amazon EventBridge; container findings are also sent to Amazon ECR.checked 5 Oct 2026
- Organization management
- Inspector integrates with AWS Organizations so a delegated administrator can configure member accounts and consolidate findings.checked 5 Oct 2026
- Pricing limits
- Code repositories over 10MB are billed as multiple repositories; a 100MB repository counts as 10 repositories for billing purposes.checked 5 Oct 2026
- Purpose
- Amazon Inspector automatically discovers workloads and code repositories and scans them for software vulnerabilities and unintended network exposure.checked 5 Oct 2026
- Resources scanned
- It scans Amazon EC2 instances, container images, AWS Lambda functions, code repositories, and supported Microsoft Azure resources.checked 5 Oct 2026
- Risk prioritization
- It calculates contextualized risk scores by correlating CVE information with factors such as network access and exploitability.checked 5 Oct 2026
- SBOM exports
- Inspector can export consolidated software bills of materials for monitored resources to a preconfigured S3 bucket, in industry-standard formats.checked 5 Oct 2026
- Scanning options
- For EC2, Inspector supports agent-based scanning with AWS Systems Manager Agent and agentless vulnerability assessments.checked 5 Oct 2026
- Who it serves
- AWS describes Inspector as helping security teams and developers of any size secure and manage compliance across AWS infrastructure workloads.checked 5 Oct 2026
Alternatives to Amazon Inspector
- 1
Mondoo CSPM
Free planOpen sourceWebAPIExtensionLinux7.7Free plan - 2
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 3
Sysdig Secure
WebAPILinuxmacOS7.2From $20 a month - 4
Alibaba Cloud Container Registry
Free planWebAPILinuxWindows7.1Free plan - 5
Trivy
Free planLinuxmacOSSelf-hostedWindows7.0Free plan - 6
ZeroPath
WebAPILinuxmacOS6.5From $1,000 a month