Skip to main content
emnode
Sign up
Compliance High severity

AWS Security Hub · Inspector

Inspector.2: Container images are not scanned by Inspector

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub Inspector.2 check?

Inspector.2 fails when Amazon Inspector ECR container image scanning is not enabled in the account and region. The check confirms the ECR scan scope is active so pushed images are assessed for vulnerabilities.

Why does Inspector.2 matter?

Container images bundle an entire OS and dependency tree, and a vulnerable base layer propagates to every task and pod built from it. Without ECR scanning, a known CVE in a widely-used image can be deployed across the fleet unnoticed. Inspector scans images on push and continuously re-evaluates them as new CVEs are published, so a vulnerability disclosed after deployment still raises a finding.

How do I fix Inspector.2?

  1. Enable the ECR scan scope with aws inspector2 enable --resource-types ECR, delegated from the Organization admin for full coverage.
  2. Configure enhanced scanning on the relevant ECR repositories so images are scanned on push.
  3. Verify with aws inspector2 batch-get-account-status that ECR is active in each region.
  4. Triage findings in Security Hub and rebuild affected images from patched base layers.

Remediation script · bash

# Enable the GuardDuty base detector in every Region (run from the delegated admin account).
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  existing=$(aws guardduty list-detectors --region "$region" --query 'DetectorIds[0]' --output text)
  if [ "$existing" = "None" ]; then
    aws guardduty create-detector --enable \
      --finding-publishing-frequency FIFTEEN_MINUTES --region "$region"
    echo "$region: GuardDuty detector created"
  fi
done

# Turn on Inspector EC2/ECR/Lambda scanning for this account and Region.
aws inspector2 enable --resource-types EC2 ECR LAMBDA

# Enable Macie (free bucket inventory clears Macie.1; discovery jobs are scoped separately by risk).
aws macie2 enable-macie --status ENABLED --finding-publishing-frequency FIFTEEN_MINUTES

Full walkthrough (console steps, edge cases and verification) in the lesson Enable threat detection and vulnerability scanning.

Is Inspector.2 a false positive?

Enabling ECR enhanced scanning to satisfy this control is a deliberate trade-off, not a free pass: it replaces ECR's no-charge basic scanning with Inspector enhanced scanning, which is billed through Amazon Inspector. An account that pushes no container images, or one where you have consciously chosen to stay on basic scanning for cost reasons, will fail Inspector.2 by design. Rather than turning on a billed feature you don't use, suppress the finding in Security Hub with a documented justification. The other stuck case is the same as the EC2 control: a suspended member account keeps the delegated administrator's finding FAILED until you disassociate it from Inspector.

Full lesson Enable threat detection and vulnerability scanning Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for Inspector controls ↗ Check your own account for Inspector.2 →
Part of the learning path See what's happening

More Inspector controls