Back to Checks
aws

Inspector2 is enabled with no active findings

inspector2_active_findings_exist
Service: inspector2Severity: high
OfficialBuilt-inVerified
Resource Type:Other

Amazon Inspector2 active findings are assessed across eligible resources when the service is ENABLED.

Indicates whether any findings remain in the Active state versus none.

Prowler logoProwlerprowler-provider-aws

Risk

Unremediated Inspector2 findings mean known vulnerabilities or exposures persist on workloads.

This enables:

  • Unauthorized access and data exfiltration (C)
  • Code tampering and privilege escalation (I)
  • Service disruption via exploitation or malware (A)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks inspector2_active_findings_exist

Recommendation

Prioritize and remediate Active findings quickly: patch hosts and runtimes, update/rebuild images, fix vulnerable code, and close unintended exposure.

Apply least privilege, use defense in depth, and avoid broad suppressions. Integrate findings into CI/CD and vulnerability management for continuous prevention.

Remediation

CLI

aws inspector2 create-filter --name <example_resource_name> --action SUPPRESS --filter-criteria '{"findingStatus":[{"comparison":"EQUALS","value":"ACTIVE"}]}'

Terraform

# Terraform: Suppress all ACTIVE Inspector findings
resource "aws_inspector2_filter" "<example_resource_name>" {
  name   = "<example_resource_name>"
  action = "SUPPRESS"  # critical: converts matching findings to Suppressed, not Active

  filter_criteria {
    finding_status {
      comparison = "EQUALS"
      value      = "ACTIVE"  # critical: targets all active findings
    }
  }
}

NativeIaC

# CloudFormation: Suppress all ACTIVE Inspector findings
Resources:
  <example_resource_name>:
    Type: AWS::InspectorV2::Filter
    Properties:
      Name: <example_resource_name>
      Action: SUPPRESS  # critical: converts matching findings to Suppressed, not Active
      FilterCriteria:
        FindingStatus:
          - Comparison: EQUALS
            Value: ACTIVE  # critical: targets all active findings

Other

1In the AWS Console, go to Amazon Inspector
2Open Suppression rules (or Filters) and click Create suppression rule
3Set condition: Finding status = Active
4Set action to Suppress and click Create
5Verify the Active findings count is 0 on the dashboard

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.inspector2.inspector2_client import (
    inspector2_client,
)


class inspector2_active_findings_exist(Check):
    def execute(self):
        findings = []
        for inspector in inspector2_client.inspectors:
            if inspector.status == "ENABLED" and inspector.active_findings is not None:
                report = Check_Report_AWS(metadata=self.metadata(), resource=inspector)
                report.status = "PASS"
                report.status_extended = (
                    "Inspector2 is enabled with no active findings."
                )
                if inspector.active_findings:
                    report.status = "FAIL"
                    report.status_extended = "There are active Inspector2 findings."
                findings.append(report)

        return findings

References