AWS accounts where Amazon Inspector vulnerability scanning is off

What Amazon Inspector would be catching

Amazon Inspector discovers and scans EC2 instances, container images in Amazon ECR and Lambda functions, and raises a finding when it detects a software vulnerability or unintended network exposure. It is the managed answer to “which of my workloads are running a package with a published CVE?”

With Inspector off, that question has no automatic answer. Patching depends on someone noticing an advisory and mapping it to the right AMIs, images and function packages by hand, which rarely happens for workloads nobody is actively developing.

Reading Inspector account status yourself

The account status call reports both an overall state and one state per resource type:

aws inspector2 batch-get-account-status \
  --query 'accounts[].[accountId,state.status]' --output table

aws inspector2 batch-get-account-status \
  --query 'accounts[].resourceState'

Overall and per-type status values include ENABLED, DISABLED, SUSPENDED and the transitional ENABLING and DISABLING. Run it in each Region you use.

The account-level signal this rule reads

ZopNight records the overall Inspector state for the account in each Region it scans and raises a finding when that state is anything other than ENABLED, which includes DISABLED, SUSPENDED and the transitional states. It fires on the recorded flag alone; nothing about tags or naming affects it.

Coverage gaps this check cannot see

The rule reads only the overall status. An account can have Inspector running for ECR images while EC2 or Lambda scanning is turned off, and AWS reports that account as enabled overall, so ZopNight does not raise a finding. Use the resourceState query above to find those partial setups.

When the status cannot be read at all, for instance because the scanning role lacks Inspector permissions, no finding is produced rather than a guess.

What turning Inspector on costs

This is a security finding with no saving attached. Inspector charges per scanned resource, and all accounts new to Inspector get a 15-day free trial during which eligible EC2 instances, Lambda functions and ECR images are scanned at no cost. Use that window to see what the steady-state bill will be.

Switching scanning on for every resource type

1. Enable Inspector with the scan types you need:

aws inspector2 enable --resource-types EC2 ECR LAMBDA LAMBDA_CODE

2. Repeat per Region, or enable it across the organization from a delegated administrator account.
3. Confirm with the resourceState query that each type reports ENABLED.
4. Triage the initial findings by severity, then send new ones to your ticketing or chat tool through EventBridge.