Finding types in Amazon Inspector
Amazon Inspector generates findings for Amazon Elastic Compute Cloud (Amazon EC2) instances, container images in Amazon Elastic Container Registry (Amazon ECR) repositories, and AWS Lambda functions. Amazon Inspector can generate the following types of findings.
Package vulnerability
Package vulnerability findings identify software packages in your AWS environment
that are exposed to Common Vulnerabilities and Exposures (CVEs). Attackers can exploit
these unpatched vulnerabilities to compromise the confidentiality, integrity, or
availability of data, or to access other systems. The CVE system is a reference method
for publicly known information security vulnerabilities and exposures. For more
information, see https://www.cve.org/
CVE detections for Linux are added to Amazon Inspector within 24 hours of release by vendor security advisories. CVE detections for Windows are added to Amazon Inspector within 48 hours of being released by Microsoft. You can use the Amazon Inspector vulnerability database search to see if a CVE detection is supported.
Amazon Inspector can generate package vulnerability findings for EC2 instances, ECR container images, and Lambda functions. Package vulnerability findings have additional details unique to this finding type, these are the Inspector score and vulnerability intelligence.
Code vulnerability
Code vulnerability findings identify lines in your code that attackers could exploit. Code vulnerabilities include injection flaws, data leaks, weak cryptography, or missing encryption in your code.
Amazon Inspector evaluates your Lambda function application code using automated reasoning and machine learning that analyzes your application code for overall security compliance. It identifies policy violations and vulnerabilities based on internal detectors developed in collaboration with Amazon CodeGuru. For a list of possible detections, see CodeGuru Detector Library.
Important
Amazon Inspector code scanning captures code snippets to highlight detected vulnerabilities. These snippets may show hardcoded credentials or other sensitive materials in plaintext.
Amazon Inspector can generate Code vulnerability findings for Lambda functions if you have Amazon Inspector Lambda code scanning activated.
Code snippets detected in connection with a code vulnerability are stored by the CodeGuru service. By default an AWS owned key controlled by CodeGuru is used to encrypt your code, however, you can use your own customer managed key for encryption through the Amazon Inspector API. For more information see Encryption at rest for code in your findings.
Network reachability
Network reachability findings indicate that there are open network paths to Amazon EC2 instances in your environment. These findings appear when your TCP and UDP ports are reachable from the VPC edges, such as an internet gateway (including instances behind Application Load Balancers or Classic Load Balancers), a VPC peering connection, or a VPN through a virtual gateway. These findings highlight network configurations that may be overly permissive, such as mismanaged security groups, Access Control Lists, or internet gateways, or that may allow for potentially malicious access.
Amazon Inspector only generates network reachability findings for Amazon EC2 instances. Amazon Inspector performs scans for network reachability findings every 24 hours.
Amazon Inspector evaluates the following configurations when scanning for network paths:
