Amazon Inspector & AWS Trusted Advisor
Two complementary automated-checking services: Inspector continuously scans workloads for software vulnerabilities and network exposure, while Trusted Advisor checks account configuration against cost, security, performance, and fault-tolerance best practices.
Want a visual for this topic?
Generate a diagram tailored to Amazon Inspector & AWS Trusted Advisor — the AI picks whichever visual (architecture, flowchart, ER diagram, etc.) best fits this specific AWS concept.
Sign in to generate a visual →🎓 Learning objectives
- •Explain what Amazon Inspector scans and how it differs from a manual security audit
- •Explain what AWS Trusted Advisor checks and how check availability differs by support plan
- •Distinguish Inspector's vulnerability-focused scope from Trusted Advisor's broader best-practices scope
- •Identify which service would surface a specific finding — an outdated package with a known CVE versus an underutilized EC2 instance
What is it?
Amazon Inspector is an automated vulnerability management service that continuously scans EC2 instances, container images in ECR, and Lambda functions for known software vulnerabilities (CVEs) and, for EC2, unintended network exposure. AWS Trusted Advisor is a broader account-level advisor that checks your AWS resource configuration against best practices across five categories — cost optimization, security, fault tolerance, performance, and service limits — surfacing recommendations like unattached EBS volumes, overly permissive security groups, or services approaching their account limits.
Why it exists
Manually tracking whether every EC2 instance, container image, and Lambda function is running software with known vulnerabilities is impractical at any real scale, and vulnerabilities are discovered continuously after deployment, not just at build time — Inspector exists to make this an ongoing, automated process rather than a periodic manual audit. Separately, an AWS account accumulates configuration drift and inefficiency over time — forgotten resources, overly broad permissions, missed cost-saving opportunities — that no single team member is likely to systematically review across every service; Trusted Advisor exists to continuously check for these patterns automatically.
Problem it solves
Inspector solves continuous vulnerability visibility — new CVEs are matched against your deployed software automatically as they're published, not just at initial deployment, and it also flags EC2 instances with network paths reachable from the internet that shouldn't be. Trusted Advisor solves the 'we don't have anyone systematically checking basic best practices across every service' problem, surfacing concrete, actionable findings across cost, security, and reliability without requiring a dedicated ongoing audit process.
Intuition
Inspector is like a building inspector who doesn't just check the building once when it's built, but keeps re-checking it every time a new safety code is published, flagging exactly which parts of the building would now fail that new code. Trusted Advisor is more like a general contractor doing a walkthrough of an entire property looking for a wide range of common issues — a running faucet wasting money (unused resources), an unlocked door (overly permissive security group), or a room close to capacity (a service limit close to being hit) — a broader, best-practices sweep rather than a specialized vulnerability scan.
Analogy
Inspector is a food safety inspector checking specifically whether ingredients (software packages) have passed their expiration date or been recalled (have a known CVE). Trusted Advisor is more like a full restaurant health and business inspection covering fire exits (fault tolerance), whether the till is being run efficiently (cost optimization), and whether the kitchen is following general best practice (security, performance) — a broader review, not focused on one specific risk category.
Technical explanation
Inspector automatically discovers eligible resources (EC2 instances with the SSM Agent, ECR repositories, Lambda functions) once enabled, requiring no manual scan scheduling, and re-evaluates all of them automatically whenever the underlying vulnerability database (CVE data) updates, not just when the resource itself changes — meaning a previously 'clean' instance can generate a new finding the moment a new CVE affecting one of its installed packages is published. Inspector also performs network reachability analysis for EC2, identifying instances with a network path open to the internet, factoring that exposure into a finding's risk score. Trusted Advisor's core checks (a limited set, mostly around service limits and a few security basics) are available to all accounts; the full set of checks across all five categories requires a Business, Enterprise On-Ramp, or Enterprise support plan — a detail worth knowing since Basic/Developer support plans see a much smaller subset of findings.
Architecture
A platform team enables Inspector across all AWS accounts in their organization via AWS Organizations integration, with findings aggregated centrally and high-severity findings triggering an EventBridge rule that opens a ticket automatically. Separately, they review the Trusted Advisor dashboard monthly (available in full since they're on a Business support plan), acting on cost-optimization recommendations like rightsizing underutilized EC2 instances and removing long-unattached EBS volumes identified there.
Workflow
- Enable Amazon Inspector (per account or organization-wide) to begin continuous vulnerability scanning of eligible EC2, ECR, and Lambda resources. 2) Triage findings by severity, prioritizing ones with both a high CVE severity and confirmed network exposure. 3) Separately, review the Trusted Advisor dashboard regularly (frequency and depth depending on your support plan tier) across its five categories. 4) Act on cost, security, and fault-tolerance recommendations, treating Trusted Advisor as a recurring best-practices checklist rather than a one-time audit.
Example
A team's Inspector scan flags a Lambda function using a Python library with a newly published critical CVE, generated automatically the day the CVE was published even though the function's code itself hadn't changed in months — prompting an immediate dependency update. In the same week, Trusted Advisor's cost-optimization category flags three EC2 instances running at under 10% average CPU utilization over the past two weeks, leading the team to downsize them and reduce monthly spend.
Real-world usage
Inspector is commonly enabled organization-wide as a baseline vulnerability management control, often feeding into a security team's ticketing or SIEM pipeline via EventBridge. Trusted Advisor is widely used by cost-conscious teams and by support-plan holders (Business/Enterprise) as a recurring operational review checklist, and its findings are frequently referenced directly in AWS well-architected review exercises.
Trade-offs
The cost of enabling both is generally low relative to the value of continuous, automated coverage versus relying entirely on manual review — the real tradeoff is less about whether to use them and more about which support plan tier is worth paying for to unlock Trusted Advisor's full checklist, which is a genuine cost decision for smaller accounts on Basic/Developer support.
Visual explanation
Picture Inspector continuously scanning a fleet of EC2 instances, ECR repositories, and Lambda functions against an always-updating vulnerability database, producing a prioritized list of findings ranked by severity (based on both the vulnerability's exploitability and the resource's actual network exposure). Picture Trusted Advisor as a dashboard with five colored category panels (cost, security, fault tolerance, performance, service limits), each populated with specific, resource-level recommendations like 'this EBS volume has been unattached for 30 days' or 'this security group allows unrestricted SSH access from 0.0.0.0/0.'
Advantages
- —
Inspector re-evaluates resources automatically as new vulnerabilities are published, not just at deployment time — continuous, not point-in-time
- —
Inspector factors in actual network reachability, helping prioritize genuinely exploitable findings over theoretical ones
- —
Trusted Advisor surfaces concrete, resource-specific, actionable recommendations rather than abstract best-practice advice
- —
Both require no custom tooling or scripts to build — the checking logic is fully managed by AWS
Disadvantages
- —
Trusted Advisor's full checklist across all five categories is gated behind Business/Enterprise support plans, limiting Basic/Developer plan accounts to a small core subset
- —
Inspector only covers EC2, ECR, and Lambda — it doesn't scan every AWS resource type or catch application-logic vulnerabilities, only known package/OS-level CVEs and EC2 network exposure
- —
Neither service replaces a genuine security review or penetration test — both are automated baseline checks, not a substitute for deeper analysis
Common mistakes
- —
Assuming a clean Inspector scan result is permanent, when a new finding can appear later purely because a new CVE was published, with no change to the resource itself
- —
Not realizing Trusted Advisor's full check set requires Business or higher support plan, and being confused why only a handful of checks show up on Basic support
- —
Treating Inspector or Trusted Advisor findings as optional informational notes rather than acting on high-severity/high-confidence ones promptly
- —
Expecting Inspector to catch application-logic security flaws — it's scoped to known package/OS vulnerabilities and network exposure, not custom code review
In the AWS Console
- 1
AWS Console → Inspector → Get started → Enable Inspector
Enable scanning for EC2, ECR, and/or Lambda, optionally across your full AWS Organization.
EC2 instances need the SSM Agent running and properly configured for Inspector to discover and scan them.
- 2
AWS Console → Trusted Advisor → Dashboard
Review findings across the five categories: cost optimization, security, fault tolerance, performance, and service limits.
The number of visible checks depends directly on your account's AWS Support plan tier — Basic/Developer plans see only a limited core subset.
🎤 Interview questions
How does Amazon Inspector's continuous scanning differ from a traditional point-in-time vulnerability scan? (Listen for: it automatically re-evaluates resources whenever the underlying CVE database updates, generating new findings without any change to the resource itself.)
What are the five categories AWS Trusted Advisor checks across? (Listen for: cost optimization, security, fault tolerance, performance, and service limits.)
If a Basic support plan account sees very few Trusted Advisor checks compared to a colleague's Business support account, why? (Listen for: the full Trusted Advisor checklist across all five categories requires a Business, Enterprise On-Ramp, or Enterprise support plan; Basic/Developer plans get a much smaller core subset.)
Would Inspector catch a SQL injection vulnerability in custom application code? (Listen for: no — Inspector scans for known package/OS-level CVEs and EC2 network exposure, not custom application logic flaws; that requires a different tool like a code security scanner or manual review.)
How does Inspector factor network exposure into a finding's risk score for an EC2 instance? (Listen for: it performs network reachability analysis to determine if a vulnerable instance is actually reachable from the internet, prioritizing exploitable findings over theoretical ones with no real network path.)