Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Resource type:
inspector2_is_enabledProvider: AWS
Service:
inspector2Severity: MEDIUM
Resource type:
OtherWhat this check verifies
Amazon Inspector 2 activation and coverage across regions, verifying that scanning is active for EC2, ECR, Lambda functions, and Lambda code where applicable. It flags missing account activation or gaps in any scan type.Risk
Absent or partial coverage leaves unpatched vulnerabilities, risky code dependencies, and unintended network exposure undetected. Attackers can exploit known CVEs for remote code execution, lateral movement, and data exfiltration, degrading confidentiality, integrity, and availability.Recommendation
Enable Amazon Inspector 2 across all regions and activate scans for EC2, ECR, Lambda, and Lambda code. Apply defense in depth: auto-enable coverage for new workloads, integrate findings with patching and CI/CD gates, enforce remediation SLAs, and grant only least privilege to process and act on findings.Remediation
- CLI
- Terraform
- Dashboard steps
aws inspector2 enable —resource-types EC2 ECR LAMBDA LAMBDA_CODE
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/Inspector2/enable-amazon-inspector2.html
- https://docs.aws.amazon.com/inspector/latest/user/findings-understanding.html
- https://docs.aws.amazon.com/inspector/latest/user/getting_started_tutorial.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = inspector2_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks