What Inspector Actually Scans, Resource by Resource

For EC2, Inspector scans the operating system and installed software packages for known CVEs, and separately performs network reachability analysis to determine whether a vulnerable instance is actually exposed to the internet — a critical distinction, since a vulnerable-but-unreachable instance is a lower practical risk than a vulnerable-and-internet-facing one, and Inspector's risk scoring reflects this. For ECR, Inspector scans container image layers for known OS package and application dependency CVEs, both on initial push and continuously as new CVEs are published against already-pushed images. For Lambda, Inspector scans function code and its dependencies (including layers) for known vulnerabilities, again continuously, not just at deployment. Across all three, Inspector requires no scan scheduling or manual triggering once enabled — it's a fully automated, continuously running baseline.