Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Inspector finding types

This section describes the different finding types in Amazon Inspector.

Package vulnerability

Package vulnerability findings identify software packages in your Amazon environment that are exposed to Common Vulnerabilities and Exposures (CVEs). Attackers can exploit these unpatched vulnerabilities to compromise the confidentiality, integrity, or availability of data, or to access other systems. The CVE system is a reference method for publicly known information security vulnerabilities and exposures. For more information, see https://www.cve.org/.

Amazon Inspector can generate package vulnerability findings for EC2 instances, ECR container images, and Lambda functions. Package vulnerability findings include details that are unique to this type of finding. These details are the Inspector score and vulnerability intelligence.

For Windows EC2 instances, package vulnerability findings can be identified by Microsoft Knowledge Base (KB) IDs instead of individual CVEs. If a KB update addresses one or more CVEs, Amazon Inspector reports a single KB finding, for example KB5023697, instead of a separate finding for each CVE. A KB finding specifies the highest CVSS score, EPSS score, and exploit availability across all constituent CVEs.

Code vulnerability

Code vulnerability findings help identify lines of code that can be exploited. Code vulnerabilities include missing encryption, data leaks, injection flaws, and weak cryptography. Amazon Inspector generates code vulnerability findings through Lambda function scanning and its Code Security feature.

Amazon Inspector evaluates Lambda function application code using automated reasoning and machine learning to analyzes application code for overall security compliance. It identifies policy violations and vulnerabilities based on internal detectors developed in collaboration with Amazon Q. For a list of possible detections, see Amazon Q Detector Library.

Code scanning captures snippets of code to highlight detected vulnerabilities. For example, a code snippet might show hardcoded credentials or other sensitive materials in plaintext. Amazon Q stores code snippets associated with code vulnerabilities. By default, your code is encrypted with an Amazon owned key. However, you can create a customer managed key to encrypt your code if you want more control over this information. For more information, see Encryption at rest for code in your findings.