Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Operating systems and programming languages that Amazon Inspector supports

Amazon Inspector can scan software applications that are installed on the following:

When Amazon Inspector scans resources, Amazon Inspector sources more than 50 data feeds, generating findings for common vulnerabilities and exposures (CVEs). Examples of these sources include vendor security advisories data feeds, and threat intelligence feeds, as well as the National Vulnerability Database (NVD) and MITRE. Amazon Inspector updates vulnerability data from source feeds at least once daily.

For Amazon Inspector to scan a resource, the resource must be running a supported operating system or using a supported programming language. The topics in this section list the operating systems, programming languages, and runtimes Amazon Inspector supports for different resources and scan types. They also list discontinued operating systems.

Supported operating systems: Amazon EC2 scanning

The following table lists the operating systems Amazon Inspector supports for the scanning of Amazon EC2 instances. It lists the source of vendor security advisories for each operating system. It also helps you determine if the supported operating systems can be scanned using agent-based scanning or agentless scanning.

When using the agent-based scanning method, you configure the SSM agent to perform continuous scans on all eligible instances. Amazon Inspector recommends that you configure a version of the SSM agent greater than 3.2.2086.0. For more information, see Working with the SSM Agent in the Amazon EC2 Systems Manager User Guide.

Supported programming languages: Amazon EC2 deep inspection

Amazon Inspector currently supports the following programming languages when scanning Amazon EC2 Linux instances for vulnerabilities in third-party software packages:

Amazon Inspector uses Systems Manager Distributor to deploy the plugin used for deep inspection in your Amazon EC2 instance. Systems Manager Distributor supports the operating systems listed as Supported package platforms and architectures in the Systems Manager guide. Your Amazon EC2 instance's operating system must be supported by Systems Manager Distributor and Amazon Inspector for Amazon Inspector to perform deep inspection scans.

Supported operating systems: CIS scanning

The following table lists the operating systems Amazon Inspector currently supports for CIS scans. It also lists the CIS benchmark version that's used to perform scans of that operating system.

Supported operating systems: Amazon ECR scanning with Amazon Inspector

Amazon Inspector currently supports scanning the following operating systems when scanning container images in Amazon ECR repositories:. The table also lists the source of the vendor security advisories for each operating system.

Supported programming languages: Amazon ECR scanning

Amazon Inspector currently supports the following programming languages when scanning container images in Amazon ECR repositories:

Supported runtimes: Amazon Inspector Lambda standard scanning

Amazon Inspector Lambda standard scanning currently supports the following programming languages when scanning Lambda functions for vulnerabilities in third-party software packages:

Supported runtimes: Amazon Inspector Lambda code scanning

Amazon Inspector Lambda code scanning currently supports the following programming languages when scanning Lambda functions for vulnerabilities in code:

Discontinued operating systems

Standard vendor support for the operating systems listed in the following tables has been discontinued by the vendor. In the tables, the Discontinued column indicates when the vendor discontinued standard support for an operating system.

Amazon Inspector previously provided full support for these operating systems and will continue to scan Amazon EC2 instances and Amazon ECR container images that are running them. However, in accordance with vendor policy, the operating systems are no longer updated with patches and, in many cases, new security advisories are no longer released for them. In addition, some vendors remove existing security advisories and detections from their feeds when an affected operating system reaches the end of standard support. Consequently, Amazon Inspector might stop generating findings for known CVEs. Any findings that Amazon Inspector does generate for a discontinued operating system should be used for informational purposes only.

As a security best practice and for continued Amazon Inspector coverage, we encourage you to move to a current, supported version of an operating system.

Discontinued operating systems: Amazon EC2 scanning

Discontinued operating systems: Amazon ECR scanning