Back to Checks
aws

Inspector2 is enabled for Amazon EC2 instances, ECR container images, Lambda functions, and Lambda code

inspector2_is_enabled
Service: inspector2Severity: medium
OfficialBuilt-inVerified
Resource Type:Other

Amazon Inspector 2 activation and coverage across regions, verifying that scanning is active for EC2, ECR, Lambda functions, and Lambda code where applicable.

It flags missing account activation or gaps in any scan type.

Prowler logoProwlerprowler-provider-aws

Risk

Absent or partial coverage leaves unpatched vulnerabilities, risky code dependencies, and unintended network exposure undetected.

Attackers can exploit known CVEs for remote code execution, lateral movement, and data exfiltration, degrading confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks inspector2_is_enabled

Recommendation

Enable Amazon Inspector 2 across all regions and activate scans for EC2, ECR, Lambda, and Lambda code.

Apply defense in depth: auto-enable coverage for new workloads, integrate findings with patching and CI/CD gates, enforce remediation SLAs, and grant only least privilege to process and act on findings.

Remediation

CLI

aws inspector2 enable --resource-types EC2 ECR LAMBDA LAMBDA_CODE

Terraform

resource "aws_inspector2_enabler" "<example_resource_name>" {
  resource_types = ["EC2", "ECR", "LAMBDA", "LAMBDA_CODE"] # Enables Inspector2 scans for all required resource types
}

Other

1Sign in to the AWS Console and open Amazon Inspector (v2)
2If not yet activated: click Get started > Activate Amazon Inspector
3If already activated: go to Settings > Scans and ensure EC2, ECR, Lambda functions, and Lambda code are all enabled, then Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ecr.ecr_client import ecr_client
from prowler.providers.aws.services.inspector2.inspector2_client import (
    inspector2_client,
)


class inspector2_is_enabled(Check):
    def execute(self):
        findings = []
        for inspector in inspector2_client.inspectors:
            report = Check_Report_AWS(metadata=self.metadata(), resource=inspector)
            if inspector.status == "ENABLED":
                report.status = "PASS"
                report.status_extended = "Inspector2 is enabled for EC2 instances, ECR container images, Lambda functions and code."
                functions_in_region = (
                    inspector.region in awslambda_client.regions_with_functions
                )
                ec2_in_region = False
                for instance in ec2_client.instances:
                    if instance == inspector.region:
                        ec2_in_region = True
                failed_services = []

                if inspector.ec2_status != "ENABLED" and (
                    inspector2_client.provider.scan_unused_services or ec2_in_region
                ):
                    failed_services.append("EC2")
                if inspector.ecr_status != "ENABLED" and (
                    inspector2_client.provider.scan_unused_services
                    or ecr_client.registries[inspector.region].repositories
                ):
                    failed_services.append("ECR")
                if inspector.lambda_status != "ENABLED" and (
                    inspector2_client.provider.scan_unused_services
                    or functions_in_region
                ):
                    failed_services.append("Lambda")
                if inspector.lambda_code_status != "ENABLED" and (
                    inspector2_client.provider.scan_unused_services
                    or functions_in_region
                ):
                    failed_services.append("Lambda Code")

                if failed_services:
                    report.status = "FAIL"
                    report.status_extended = f"Inspector2 is not enabled for the following services: {', '.join(failed_services)}."
                findings.append(report)
            else:
                report.status = "FAIL"
                report.status_extended = "Inspector2 is not enabled in this account."
                findings.append(report)

        return findings

References