Regions where Amazon Inspector vulnerability scanning is confirmed disabled
What does ZopNight detect here?
Amazon Inspector v2 scans EC2 instances, ECR container images, and Lambda functions for known CVEs and unintended network reachability across all 3 surfaces continuously. ZopNight raises this finding only when the discoverer positively reads enabled=false for the account and region; an unreadable state produces no finding at all.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1101 |
| Category | compliance |
| Severity | high |
| Metric | none — pure configuration read |
| Source | inspector_disabled.go |
Where it applies
Vulnerability management, not threat detection
Inspector answers a different question from GuardDuty, and the two are frequently confused into a single “security is on” checkbox. GuardDuty watches behaviour: is something attacking you now. Inspector watches software state: which of your EC2 instances, ECR images, and Lambda functions carry known-exploitable package versions, and which of those are additionally reachable from the network. An account can have spotless threat detection and still be running a two-year-old OpenSSL everywhere; only Inspector reports that.
The evidence gate
The discoverer probes the Inspector account status and writes an explicit enabled flag into the resource metadata. Only a confirmed false fires. A missing or unparseable flag (the probe was denied, the region errored) abstains, because “we could not read the scanner’s status” and “the scanner is off” are different claims and only the second belongs on a compliance report. A fired finding is therefore a proven statement about the region, not an inference.
What continuous scanning changes operationally
Point-in-time scanners produce a report that is stale by the next deploy. Inspector v2 re-evaluates when a new CVE is published or when a workload changes. A fresh critical CVE in a base image surfaces against every affected ECR image and running instance within hours, ranked by an exploitability-aware score rather than raw CVSS. That ranking matters at fleet scale: an internet-reachable instance with a network-exploitable CVE and a private batch worker with the same package are not the same priority, and Inspector’s reachability analysis distinguishes them for you.
Query the current state
aws inspector2 batch-get-account-status \ --query 'accounts[].[accountId,state.status,resourceState.ec2.status,resourceState.ecr.status,resourceState.lambda.status]' \ --output tableEnable it where it compounds
Per-account enablement works, but the multiplier is AWS Organizations: delegate an admin account and auto-enable EC2, ECR, and Lambda scanning for every member, so new accounts are born covered. Pricing scales with scanned instances and images; the finding itself carries no savings figure because turning a scanner on never does. It trades a known monthly cost for not learning about a CVE from an incident channel.