Detect known vulnerabilities in EC2 hosts and container images.
Refresh findings when the assets change.
Which service is most appropriate?
Enable Amazon Inspector for continuous vulnerability scanning of supported EC2, ECR, and Lambda resources.
Detailed explanation
Inspector continuously scans supported workloads and container images for known vulnerabilities.
Inspector continuously scans supported workloads and container images for known vulnerabilities.
API auditing does not scan software for vulnerabilities.
API auditing does not scan software for vulnerabilities.
S3 versioning does not assess host or image vulnerabilities.
S3 versioning does not assess host or image vulnerabilities.
DNS reachability does not perform vulnerability assessment.
DNS reachability does not perform vulnerability assessment.
Check official documentation
Compare the following points with the official documentation.
Amazon Inspector continuous scanningの公式説明を確認する。
What to confirm
GuardDutyの脅威検知とInspectorの脆弱性評価を区別できる。
Key points
- Amazon Inspector
- EC2 scan
- ECR scan
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Vulnerability versus threat
Inspector finds software weaknesses; GuardDuty detects suspicious activity.
Continuous assessment
Asset changes and new vulnerability intelligence can update findings.