Freedom251 › Container Image Scanning Tools
Amazon Inspector
What Amazon Inspector is
Amazon Inspector is a cloud security service that discovers workloads and code repositories, then scans for software vulnerabilities and unintended network exposure. It covers Amazon EC2 instances, container images, AWS Lambda functions, code repositories, and supported Microsoft Azure resources. For EC2, teams can choose scanning with AWS Systems Manager Agent or agentless vulnerability assessments. Inspector calculates contextual risk scores by combining CVE information with factors such as network access and exploitability, helping security teams and developers assess findings. Findings appear in the Inspector console, can be routed to AWS Security Hub, and can be sent through Amazon EventBridge; container findings also go to Amazon ECR. AWS Organizations integration supports delegated administration across member accounts. Inspector also connects with Jenkins and TeamCity for container image assessments, and GitHub and GitLab for identifying code, dependency, and infrastructure-as-code issues. Teams can export software bills of materials to a preconfigured S3 bucket. It supports compliance work involving NIST CSF and PCI DSS. The service is paid, with a 15-day trial; repository sizes above 10 MB count as multiple repositories for billing.
Who it suits
It suits security teams and developers securing AWS infrastructure and managing compliance. It may also fit organizations that need scans across supported Azure resources or code repositories.
What it does well
- Scans EC2, containers, Lambda, repositories, and supported Azure resources.
- Offers agent-based and agentless EC2 assessments.
- Prioritizes findings using contextual risk scores.
- Integrates with AWS Organizations and security event services.
- Exports software bills of materials to S3.
What to know first
- No free plan; paid service after the 15-day trial.
- Repositories over 10 MB count as multiple repositories for billing.
- CIS Benchmark assessments are excluded from the 15-day trial.
Limits
The trial excludes CIS Benchmark assessments and includes one-time free usage for 25 on-demand CI/CD image assessments for new accounts. Repositories over 10 MB are billed as multiple repositories; for example, a 100 MB repository counts as 10.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| 15-day free trial | 15 days for eligible scans; CIS Benchmark assessments excluded. · New Amazon Inspector accounts · one-time free usage for 25 on-demand CI/CD image assessments | Free |
| Azure scanning free trial | 30 days after setting up Microsoft Azure integration. · Azure vulnerability scanning | Free |
| Amazon Inspector pay-as-you-go | Monthly, based on workloads scanned; no minimum fees or upfront commitments. · EC2 instances · ECR container images · Lambda functions · code repositories · Azure workloads | On request |
As aws.amazon.com lists them, read 5 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Amazon Inspector website
- Start the 15-day free trial for eligible scans
- Select EC2, ECR, Lambda, repositories, or Azure workloads to scan
- Choose agent-based or agentless EC2 assessment
- Connect GitHub, GitLab, Jenkins, or TeamCity as needed
- Route findings to Security Hub or EventBridge
Verdict
Amazon Inspector brings workload, container, serverless, repository, and supported Azure scanning into a cloud service with risk prioritization and AWS integrations. Check the trial terms and repository billing rules when estimating its fit.
Questions
Is there a free trial?
Yes. Eligible scans have a 15-day free trial. Azure vulnerability scanning has a separate 30-day free trial after the Microsoft Azure integration is set up.
What does Amazon Inspector scan?
It scans Amazon EC2 instances, Amazon ECR container images, AWS Lambda functions, code repositories, and supported Microsoft Azure resources.
Which platforms are available?
Amazon Inspector is available through API and web interfaces and uses a cloud deployment model.
Does it integrate with developer tools?
Yes. It integrates with Jenkins and TeamCity for container image assessments and has native GitHub and GitLab integrations for code, dependencies, and infrastructure as code.
How is it priced?
The pay-as-you-go plan is billed monthly based on workloads scanned, with no minimum fees or upfront commitments. Code repositories over 10 MB are billed as multiple repositories.
Facts from Amazon Inspector's own pages
- Code repository integrations
- The FAQ describes native integrations with GitHub and GitLab for identifying and prioritizing vulnerabilities and misconfigurations in source code, dependencies, and infrastructure as code. · aws.amazon.com, 5 Oct 2026
- Compliance use
- AWS says Inspector scans can support requirements and best practices including NIST CSF and PCI DSS. · aws.amazon.com, 5 Oct 2026
- Developer tools
- Inspector integrates with Jenkins and TeamCity for container image assessments, and CI/CD tools can be hosted in AWS, on premises, or in hybrid clouds. · aws.amazon.com, 5 Oct 2026
- Integrations
- Findings are aggregated in the Inspector console, routed to AWS Security Hub, and pushed through Amazon EventBridge; container findings are also sent to Amazon ECR. · aws.amazon.com, 5 Oct 2026
- Organization management
- Inspector integrates with AWS Organizations so a delegated administrator can configure member accounts and consolidate findings. · aws.amazon.com, 5 Oct 2026
- Pricing limits
- Code repositories over 10MB are billed as multiple repositories; a 100MB repository counts as 10 repositories for billing purposes. · aws.amazon.com, 5 Oct 2026
- Purpose
- Amazon Inspector automatically discovers workloads and code repositories and scans them for software vulnerabilities and unintended network exposure. · aws.amazon.com, 5 Oct 2026
- Resources scanned
- It scans Amazon EC2 instances, container images, AWS Lambda functions, code repositories, and supported Microsoft Azure resources. · aws.amazon.com, 5 Oct 2026
- Risk prioritization
- It calculates contextualized risk scores by correlating CVE information with factors such as network access and exploitability. · aws.amazon.com, 5 Oct 2026
- SBOM exports
- Inspector can export consolidated software bills of materials for monitored resources to a preconfigured S3 bucket, in industry-standard formats. · aws.amazon.com, 5 Oct 2026
- Scanning options
- For EC2, Inspector supports agent-based scanning with AWS Systems Manager Agent and agentless vulnerability assessments. · aws.amazon.com, 5 Oct 2026
- Who it serves
- AWS describes Inspector as helping security teams and developers of any size secure and manage compliance across AWS infrastructure workloads. · aws.amazon.com, 5 Oct 2026
Where Amazon Inspector stands on Freedom251
- Container Image Scanning Tools#13 of 29
- Vulnerability Scanning Software#18 of 35
- Cloud Vulnerability Scanners#15 of 28