Inspector2 is enabled with no active findings

Check ID: inspector2_active_findings_exist
Provider: AWS
Service: inspector2
Severity: HIGH
Resource type: Other

What this check verifies

Amazon Inspector2 active findings are assessed across eligible resources when the service is ENABLED. Indicates whether any findings remain in the Active state versus none.

Risk

Unremediated Inspector2 findings mean known vulnerabilities or exposures persist on workloads. This enables:

Unauthorized access and data exfiltration (C)
Code tampering and privilege escalation (I)
Service disruption via exploitation or malware (A)

Recommendation

Prioritize and remediate Active findings quickly: patch hosts and runtimes, update/rebuild images, fix vulnerable code, and close unintended exposure. Apply least privilege, use defense in depth, and avoid broad suppressions. Integrate findings into CI/CD and vulnerability management for continuous prevention.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws inspector2 create-filter --name <example_resource_name> --action SUPPRESS --filter-criteria '{"findingStatus":[{"comparison":"EQUALS","value":"ACTIVE"}]}'

# Terraform: Suppress all ACTIVE Inspector findings
resource "aws_inspector2_filter" "<example_resource_name>" {
  name   = "<example_resource_name>"
  action = "SUPPRESS"  # critical: converts matching findings to Suppressed, not Active

  filter_criteria {
    finding_status {
      comparison = "EQUALS"
      value      = "ACTIVE"  # critical: targets all active findings
    }
  }
}

# CloudFormation: Suppress all ACTIVE Inspector findings
Resources:
  <example_resource_name>:
    Type: AWS::InspectorV2::Filter
    Properties:
      Name: <example_resource_name>
      Action: SUPPRESS  # critical: converts matching findings to Suppressed, not Active
      FilterCriteria:
        FindingStatus:
          - Comparison: EQUALS
            Value: ACTIVE  # critical: targets all active findings

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = inspector2_active_findings_exist. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

IAM user uses temporary credentials outside IAM and STS Inspector2 is enabled for EC2, ECR, and Lambda

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires