--- title: "AWS Inspector : A Guide to Discover Your Security Holes" description: "Discover how secure your AWS environment is with the AWS Inspector service and stay proactive against security threats!" canonical: "https://adamtheautomator.com/aws-inspector/" --- # AWS Inspector : A Guide to Discover Your Security Holes > Discover how secure your AWS environment is with the AWS Inspector service and stay proactive against security threats! Source: https://adamtheautomator.com/aws-inspector/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![AWS Inspector : A Guide to Discover Your Security Holes](https://adamtheautomator.com/wp-content/uploads/2022/05/Discover-Your-Security-Holes-with-AWS-Inspector.jpg) # AWS Inspector : A Guide to Discover Your Security Holes [![](https://secure.gravatar.com/avatar/2beb65fca997135120ed98dc6a2e57dcdf1a7d7d2f5ff687b5d91dc7ccd7a6b5?s=192&d=mm&r=g)Sagar](https://adamtheautomator.com/author/shanky-mendiratta/)7 June 20225 min. read Categories: [Cloud](/category/cloud/) Tags:[AWS](/tag/aws/) Table of Contents * [Prerequisites](#prerequisites) * [Enabling Amazon Inspector in AWS Cloud](#enabling-amazon-inspector-in-aws-cloud) * [Running Scans on AWS EC2 Instances in AWS Cloud](#running-scans-on-aws-ec2-instances-in-aws-cloud) * [Running Scans on AWS ECR Repository](#running-scans-on-aws-ecr-repository) * [Conclusion](#conclusion) Do you have an extensive infrastructure to manage in AWS public cloud? If so, inspecting and monitoring your environments and infrastructures for vulnerabilities is crucial. And the good news is that AWS has its own most widely-used service, [AWS Inspector](https://aws.amazon.com/inspector/). Amazon Inspector is a vulnerability management service that continuously scans your AWS compute resources and automatically detects the affected resources. And in this tutorial, you’ll learn what an AWS inspector is and how to execute an inspector in the AWS cloud to find vulnerabilities. Read on and start patching up security holes with AWS Inspector! ## **Prerequisites** This tutorial comprises step-by-step instructions. If you’d like to follow along, be sure you have the following in place: * An [AWS account](https://repost.aws/knowledge-center/create-and-activate-aws-account) with an [AWS EC2 instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EC2_GetStarted.html). * An AWS IAM user, an [access key ID, and a secret key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html) [set up on your local machine](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html). The AWS [IAM](https://adamtheautomator.com/iam-aws/) user must have permission to create and manage EC2 instances on AWS Cloud. Related:[Learning Identity and Access Management (IAM) AWS Through Examples](https://adamtheautomator.com/iam-aws/) ## Enabling Amazon Inspector in AWS Cloud AWS Inspector is an AWS service that cares about vulnerabilities or issues that might block you from working with AWS compute resources. But before you inspect your AWS infrastructure, you’ll need to enable the AWS Inspector by subscribing to the service. 1\. Open your favorite web browser, navigate the [AWS Management Console](https://aws.amazon.com/console/), and log in with your AWS account. > _You can centrally manage AWS inspector with multiple AWS accounts by using the AWS organization. Also, if you have more accounts in the future, you can easily enable the service._ 2\. While in AWS Management Console, search for inspector in the search box at the top, click on and click on the Inspector menu item. Your browser redirects to a page where you’ll see details about AWS Inspector (step three). ![Accessing the AWS Inspector Overview Page](https://adamtheautomator.com/wp-content/uploads/2022/05/image-702.png) Accessing the AWS Inspector Overview Page 3\. On the Amazon Inspector page, click on the Get Started button, as shown below, to initialize enabling AWS Inspector. ![Getting Started with AWS Inspector](https://adamtheautomator.com/wp-content/uploads/2022/05/image-703.png) Getting Started with AWS Inspector 4\. Finally, click on the Enable Inspector button (bottom-right) to enable the AWS Inspector. After enabling the Inspector, all scan types are enabled by default. ![Enabling the Amazon Inspector in AWS Cloud](https://adamtheautomator.com/wp-content/uploads/2022/05/image-704.png) Enabling the Amazon Inspector in AWS Cloud Once the AWS Inspector is enabled, your browser redirects to the AWS Inspector Dashboard page with a welcome message at the top, as shown below. As of now, you will see 0 instances and repositories in the Environment coverage. AWS Inspector initially takes a few minutes to scan your infrastructure after getting enabled, ![Viewing the AWS Inspector Dashboard](https://adamtheautomator.com/wp-content/uploads/2022/05/image-705.png) Viewing the AWS Inspector Dashboard ## **Running Scans on AWS EC2 Instances in AWS Cloud** You’ve just enabled AWS Inspector in AWS Cloud, and you’re now ready to scan AWS EC2 instances in AWS Cloud. AWS Inspector inspects all installed software and networking components in the AWS EC2 instance. 1\. Log in to your Ubuntu machine using your favorite SSH client. 2\. Next, run the below systemctl command to check the status of the [SSM Agent](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html). SSM agent collects information about the software application inventory of your EC2 instances. The SSM agent is installed on all AWS EC2 instances by default, but verifying the agent’s status is essential. ```bash sudo systemctl status snap.amazon-ssm-agent.amazon-ssm-agent.service ``` ![Checking the Status of the AWS SSM Agent](https://adamtheautomator.com/wp-content/uploads/2022/05/image-706.png) Checking the Status of the AWS SSM Agent Related:[Correct Way of Using Ubuntu systemctl to Control Systemd](https://adamtheautomator.com/ubuntu-systemctl/) 3\. Navigate to your Amazon EC2 dashboard and count the number of EC2 instances in your AWS account. As you can see below, there are five instances currently running in the AWS account in the us-east-01 region. ![Viewing All AWS EC2 Instances](https://adamtheautomator.com/wp-content/uploads/2022/05/image-707.png) Viewing All AWS EC2 Instances Related:[How to Manage virtual machines With Ansible EC2 AWS Module](https://adamtheautomator.com/ansible-ec2/) 4\. Now, navigate to the AWS Inspector Dashboard, where you’ll notice the Environment coverage section. Environment coverage provides the count of total resources scanned by the Amazon Inspector, such as several AWS accounts, AWS EC2 instances, and ECR repositories. > _You can continuously scan your environment or AWS resources, and later AWS inspector publishes the findings of all issues and vulnerabilities to [Amazon EventBridge](https://aws.amazon.com/eventbridge/)._ In the screenshot below, you can see five instances that the AWS Inspector scanned. ![Viewing Environment Coverage for AWS EC2 instance](https://adamtheautomator.com/wp-content/uploads/2022/05/image-708.png) Viewing Environment Coverage for AWS EC2 instance You can also see the Critical findings, which provide the essential vulnerabilities in your environment and a total count of all findings in your environment. > _AWS inspector provides a well-structured Dashboard that provides a high level of findings across environments._ Below, the critical findings on each instance are zero (0), but the AWS Inspector showed one (1) in the All column, which signifies a High-Priority finding. ![Viewing Critical Vulnerabilities in AWS Inspector for AWS EC2 Instance](https://adamtheautomator.com/wp-content/uploads/2022/05/image-709.png) Viewing Critical Vulnerabilities in AWS Inspector for AWS EC2 Instance 5\. Click on any of the instances to access its critical findings. ![Accessing an Instance Critical Findings](https://adamtheautomator.com/wp-content/uploads/2022/05/image-710.png) Accessing an Instance Critical Findings Below, you can see 1 High priority finding. This high priority finding shows the title saying Port range 0 to 65535 is reachable from an Internet Gateway. This finding warns that it’s a risk for an infrastructure to open many ports. ![Checking High Findings in AWS inspector for AWS EC2 ](https://adamtheautomator.com/wp-content/uploads/2022/05/image-711.png) Checking High Findings in AWS inspector for AWS EC2 6\. Finally, click on High under the Severity table shown below to see more details on the findings, such as Network, which can cause vulnerabilities or attackers attacking the system. As you can see below, the Open Network Paths suggest that the network causing security concerns is from Internet Gateway > Network ACL > Security Group > Network Interface > Instance in the AWS Cloud (red box). You’ll also see that AWS Inspector provides remediation (green box) so that you can act upon it. ![Viewing AWS Inspector Findings on the AWS EC2 Instance Level](https://adamtheautomator.com/wp-content/uploads/2022/05/image-712.png) Viewing AWS Inspector Findings on the AWS EC2 Instance Level ## **Running Scans on AWS ECR Repository** You previously scanned your AWS EC2 instances and went through critical findings based on priority. But this time, you’ll scan container images stored in [Amazon Elastic Container Registry (ECR)](https://aws.amazon.com/ecr/) for software vulnerabilities. 1\. On the AWS Management Console, search for ecr, and select the Elastic Container Registry menu item shown below. ![Opening AWS ECR Console](https://adamtheautomator.com/wp-content/uploads/2022/05/image-713.png) Opening AWS ECR Console 2\. Next, click on the Get Started (top-right) button to create an ECR repository. ![Creating the ECR Repository](https://adamtheautomator.com/wp-content/uploads/2022/05/image-714.png) Creating the ECR Repository 3\. Specify the details of the new repository, such as Visibility settings and Repository name, and click on the Save button (bottom) to save the new repository. You can choose the repository name as you like, but this tutorial’s choice is ata-learning-ecr. After saving the repository, your browser redirects to the Amazon Elastic Container Registry page (step four) ![Providing Details for the New ECR Repository](https://adamtheautomator.com/wp-content/uploads/2022/05/image-715.png) Providing Details for the New ECR Repository 4\. Now, navigate to the Private registry page (left panel), and click on Edit under the Scanning configuration section to edit the registry settings. ![Editing the Scanning configuration](https://adamtheautomator.com/wp-content/uploads/2022/05/image-716.png) Editing the Scanning configuration 5\. Edit the Scanning configuration with the following: * Select the **Enhanced scanning** option. Enhanced scanning allows AWS Inspector to scan all the AWS ECR repositories automatically. This option gives you a choice between continuous scanning or on-push scanning at the repository level. * Check the **Continuously scan of all repositories** box. Continuous scanning includes on-push scans and automated rescans. * Click on the **Save** button to save the configuration. > _On-push scanning scans only work when you push an image._ ![Editing Scanning Configuration](https://adamtheautomator.com/wp-content/uploads/2022/05/image-717.png) Editing Scanning Configuration 6\. Navigate back to the AWS Inspector main page, and you’ll notice the Summary page shows one repository in the Environment coverage you just created. The below summary indicates that AWS Inspector detected/scanned the ECR repository. Click on 100% under repositories, and your browser redirects to the Account management page, where you can view the scan details. ![Viewing the Repository Being Scanned by AWS Inspector](https://adamtheautomator.com/wp-content/uploads/2022/05/image-718.png) Viewing the Repository Being Scanned by AWS Inspector 7\. Finally, click on the Repositories tab on the Account management page details to view the scan details. As you can see below, there are no issues or findings made so far for this repository by AWS Inspector, indicating there are no security risks in the ECR repository you created. ![Checking the Repositories in AWS Inspector](https://adamtheautomator.com/wp-content/uploads/2022/05/image-719.png) Checking the Repositories in AWS Inspector ## **Conclusion** In this tutorial, you’ve learned how to discover security holes in your AWS EC2 instances and AWS ECR within AWS Cloud using AWS Inspector. Building a secure cloud infrastructure is crucial, and AWS Inspector is a service that one must use to scan for vulnerabilities. At this point, you’re now ready to use this knowledge with other AWS services and secure your powerful services with Amazon Inspector. > _AWS Inspector integrates with various AWS services such as AWS CloudWatch, and CloudTrail._ Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Faws-inspector%2F&text=AWS%20Inspector%20%3A%20A%20Guide%20to%20Discover%20Your%20Security%20Holes)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Faws-inspector%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Faws-inspector%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image-1.webp) ### [Survive the Senior Cloud Engineer AWS Interview Loop](/senior-cloud-engineer-interview-loop/) Prepare for a senior cloud engineer interview with AWS EKS and Control Tower system design reasoning, Terraform locking, and salary negotiation tactics. ![](https://adamtheautomator.com/wp-content/uploads/2026/02/featured_image-1-scaled.jpg) ### [Transition from SysAdmin to Cloud Engineer](/transition-sysadmin-cloud-engineer/) System administrators already have the networking, Linux, and operational expertise that cloud engineering demands. This guide maps the philosophy shift, technical domains, certifications, and portfolio steps to make the transition. ![](https://adamtheautomator.com/wp-content/uploads/2021/09/Terraform-AWS.jpg) ### [Terraform AWS Guide: Building Robust Amazon Infrastructure](/terraform-aws/) Master Terraform AWS with our comprehensive guide: Learn step-by-step how to manage and optimize your Amazon Infrastructure effectively and efficiently. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)