Back to Checks
aws

Inspector2 covered resource is actively scanned

inspector2_coverage_scan_status_active
Service: inspector2Severity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:Other

Amazon Inspector coverage is evaluated for every resource it tracks (EC2 instances, ECR images and repositories, Lambda functions). A resource whose scan status is INACTIVE, for example because of UNMANAGED_EC2_INSTANCE, NO_INVENTORY, UNSUPPORTED_OS or ACCESS_DENIED, is not being scanned for vulnerabilities.

Stopped, terminated, tag-excluded and aged-out resources are not evaluated.

Prowler logoProwlerprowler-provider-aws

Risk

Resources that Inspector cannot scan silently fall out of vulnerability detection. New CVEs affecting those workloads are never reported, so exploitable software can stay deployed while the account still appears covered.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks inspector2_coverage_scan_status_active

Recommendation

Resolve the reason reported in each inactive resource's scan status so Inspector can scan every in-scope workload. Register EC2 instances with Systems Manager or enable hybrid scanning, keep operating systems and runtimes supported, and treat scanning gaps as vulnerabilities to track.

Remediation

Other

1In the Amazon Inspector console, choose Account management
2Open the Instances, Container images or Lambda functions tab and review the resources that are not actively scanned
3Fix the reported cause: register EC2 instances with Systems Manager or set the EC2 scan mode to hybrid, use supported operating systems and runtimes, and grant access to the required encryption keys
4Confirm the resource is actively scanned

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.inspector2.inspector2_client import (
    inspector2_client,
)

NOT_APPLICABLE_SCAN_REASONS = {
    "EC2_INSTANCE_STOPPED",
    "EXCLUDED_BY_TAG",
    "NO_RESOURCES_FOUND",
    "PENDING_DISABLE",
    "RESOURCE_TERMINATED",
    "SCAN_ELIGIBILITY_EXPIRED",
}


class inspector2_coverage_scan_status_active(Check):
    """Ensure Inspector2 is actively scanning every covered resource."""

    def execute(self) -> list[Check_Report_AWS]:
        """Report whether Inspector2 is actively scanning each covered resource."""
        findings = []
        for inspector in inspector2_client.inspectors:
            if inspector.status != "ENABLED":
                continue
            if inspector.coverage is None:
                report = Check_Report_AWS(metadata=self.metadata(), resource=inspector)
                report.status = "MANUAL"
                report.status_extended = (
                    f"Inspector2 coverage could not be retrieved in region {inspector.region}; "
                    "verify the inspector2:ListCoverage permission."
                )
                findings.append(report)
                continue
            for resource in inspector.coverage:
                if resource.scan_status_reason in NOT_APPLICABLE_SCAN_REASONS:
                    continue
                report = Check_Report_AWS(metadata=self.metadata(), resource=resource)
                if resource.scan_status_code == "ACTIVE":
                    report.status = "PASS"
                    report.status_extended = f"Inspector2 is actively scanning {resource.resource_type} {resource.id}."
                else:
                    report.status = "FAIL"
                    reason = resource.scan_status_reason or "no reason reported"
                    report.status_extended = f"Inspector2 is not scanning {resource.resource_type} {resource.id}: {reason}."
                findings.append(report)
        return findings

References